Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6eecbfe28f389dd…

MALICIOUS

PDF

90.5 KB Created: 2021-03-20 08:54:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: e90cd6302d5ceb925ef0641884c4356d SHA-1: 6e7f8027f75257616d3b69ba2085a42407e148e4 SHA-256: c6eecbfe28f389ddbfd12e92ab7d5b461a4b55a86a9d3f048c8dcbef989e1556
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL, https://pelibifir.ru/wix?keyword=instructional+fair+ts+denison+answer+key+if21053, which is likely used to redirect the user to a malicious site. No scripts were extracted, but the presence of the malicious URL and the detection signatures suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/wix?keyword=instructional+fair+ts+denison+answer+key+if21053 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4443821/normal_601c601a5a088.pdfIn PDF document text
    • http://honey-love.ru/carmax._com_car-_buying-_process_recall-_faqx1h0q.pdfIn PDF document text
    • http://zemesod.getenjoyment.net/43899027673.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381095/normal_5ff93cb8ce412.pdfIn PDF document text
    • http://esclub.info/52283365382spzr6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374211/normal_600cbb5d96322.pdfIn PDF document text
    • http://wewofif.scienceontheweb.net/43952217009.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443824/normal_600f064c822ea.pdfIn PDF document text
    • http://duzusedolatepe.mypressonline.com/44400512676.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/falufusu/4g_lte_switcher.pdfIn PDF document text
    • https://s3.amazonaws.com/xoxaneral/xelaxutarepewavik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/347f32f6-5934-444b-a1f9-725826b32741/45903302389.pdfIn PDF document text
    • https://s3.amazonaws.com/ruzaganog/vlookup_textbox_userform_vba.pdfIn PDF document text
    • https://s3.amazonaws.com/fulazelof/cementation_of_all_ceramic_crowns.pdfIn PDF document text
    • http://bememikat.onlinewebshop.net/human_resource_management_books_for_bba.pdfIn PDF document text
    • https://s3.amazonaws.com/jazuravazaguz/static_electricity_activity_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac32afbd-0c5c-4701-a975-35549a4d440b/88446617833.pdfIn PDF document text
    • https://s3.amazonaws.com/zepifudoxapo/elemental_impurities_risk_assessment_report_format.pdfIn PDF document text
    • https://s3.amazonaws.com/bulolimepol/mujiwesaboguregedizubol.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012034.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12034 5824 bytes
SHA-256: f2694b2bd781824a2df2591ca15a56c47d512deac2083de9fd67917ee1de69c0
font_01_sfnt_off0001343a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1343A 12104 bytes
SHA-256: 7d806c78d89d94582b93dadf3bf1ee377c3478fe5fc2e9dc0710bf8bc068eaf8

Open this report in the interactive analyzer, or submit your own file for analysis.