Malicious PDF — malware analysis report

Static analysis result for SHA-256 c56af6bbd29fd556…

MALICIOUS

PDF

253.8 KB Created: 2021-04-01 14:21:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 3a4063c0cec80ccd5cdf6728548a9e7f SHA-1: 10f223c9868be4f911d28073331839da3eb28758 SHA-256: c56af6bbd29fd55632f3bbd33a840b939f94655df27f6e2026c4f19e59947b59
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses brand-impersonation credential phishing. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9207

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://melijezaziwoni.weebly.com/uploads/1/3/4/8/134851492/xakubejigukije_ratukezipevak_dezele_dafukoma.pdf.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=ellen+powell+reddit PDF link annotation
    • http://lnstagaram-verifiedbadges-from.com/paradise_lost_book_10vklbk.pdfIn PDF document text
    • http://goldstein.capital/best_note_3_battery0hyze.pdfIn PDF document text
    • http://gnoogle.site/photoshop_cs4_hair_brushes_freecvzlk.pdfIn PDF document text
    • http://turodes.iblogger.org/el_evangelio_de_santo_toms_completo.pdfIn PDF document text
    • https://melijezaziwoni.weebly.com/uploads/1/3/4/8/134851492/xakubejigukije_ratukezipevak_dezele_dafukoma.pdfIn PDF document text
    • https://nojezedefefowas.weebly.com/uploads/1/3/4/7/134762002/padaxe-lorawofi-xipepaz-sutoma.pdfIn PDF document text
    • https://vimikova.weebly.com/uploads/1/3/1/4/131437612/bidufanevukuwer.pdfIn PDF document text
    • https://lomivurusizova.weebly.com/uploads/1/3/4/8/134868764/viwijimewuwun_witipirofokanax_govoki_sanelixirewo.pdfIn PDF document text
    • http://nefuwumimo.iblogger.org/erode_district_pincode_list.pdfIn PDF document text
    • http://bt-management.website/tepopokefafunaberodejieca09.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6593eeda-10fe-4128-810f-cbbc79f0a4f8.filesusr.com/ugd/c0a4bf_a1f2e6749c674f83b94b1739f8bf85f2.pdf?index=trueIn PDF document text
    • https://7133fc40-0b9c-4701-b953-e7fafc934b44.filesusr.com/ugd/70a38d_edebbe60f0fe46cf95dbc39b3e96b2f2.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/05e837db-cb60-4b3b-8353-d4518aa7b8c9/towopuvorewevipixalebod.pdfIn PDF document text
    • https://0bdb67af-4c57-4a6e-9706-714cc80719f5.filesusr.com/ugd/fc840b_aa8e1b9e767f4987a2dbbd818125612e.pdf?index=trueIn PDF document text
    • https://76b44699-1094-4fd8-8d4a-70b7be8159c3.filesusr.com/ugd/c450b2_cddf2e903ac24e30985d44f78f0d0c25.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5f0a359-d8a7-400c-b7fa-6db27380aa36/my_to_kill_a_mockingbird_novel_unit_guide_part_two_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9bac87c-7ebb-4ece-963d-a4b58c1e8680/how_to_turn_challenges_into_opportunities_essay.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b3c2841-b6f3-429b-b09c-0966a125b9f8/3597657534.pdfIn PDF document text
    • http://tiliwadovi.epizy.com/vanilla_ice_cream_cone_nutrition_information.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c776d1c-fbc8-49b6-b89c-2d7ffc44e4c3/samsung_rf26hfendsr_aa_ice_maker_not_working.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/28403146-646c-4952-be41-5539c03e6540/buluni.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003656c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3656C 10912 bytes
SHA-256: 1657a349548b29fe7b22776ed9df57a5cbd5d0456b21cfab8ca985151c451725
font_01_sfnt_off000389b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x389B3 4612 bytes
SHA-256: 79577181945c45ed4ee7e7a48428085da07c1a14caf0358e07a535b2340f17cf
font_02_sfnt_off0003997a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3997A 2252 bytes
SHA-256: a6a8686b8fb15c9717d15c6992f5cb6599fab98c9eb18a738509255b94a7d84e
font_03_sfnt_off0003a3ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A3BA 14528 bytes
SHA-256: 72e451e92a3b880921162b84a4ed92f807a435725318d6a524f7a74619480f86
font_04_sfnt_off0003d23c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D23C 16244 bytes
SHA-256: dc743b41e5c9b9e4d56ad8c22d1311c6eb3cecbc0d04401a7a33aeed2fa7944a

Open this report in the interactive analyzer, or submit your own file for analysis.