Malicious PDF — malware analysis report

Static analysis result for SHA-256 c96ec20df1d9130d…

MALICIOUS

PDF

80.2 KB Created: 2021-04-25 10:58:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-13
MD5: ea2151840fa0f642bcfe9d5a87af7edc SHA-1: c2b6e38d5cfd40df0360d7cff6ab34e4f5349652 SHA-256: c96ec20df1d9130dee56badeadd0801e4312dd1af519c5b727b87221e971cea6
166 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The 'SE_BROWSER_INSTALL_LURE' heuristic indicates the document attempts to trick the user into installing a fake browser update or extension, a common social engineering tactic. While no scripts were directly extracted, the presence of external URIs and the overall detection suggest it likely leads to a second-stage download or exploit, potentially involving JavaScript execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=pelonis+oil+filled+heater+home+depot PDF link annotation
    • https://cdn.sqhk.co/kisasizaro/ihZxhc9/the_maxx_movie.pdfIn PDF document text
    • http://xutarima.22web.org/zixazifi.pdfIn PDF document text
    • https://cdn.sqhk.co/navuwamas/jgjXhjs/pro_pinball_timeshock.pdfIn PDF document text
    • https://tigubitutonoxib.weebly.com/uploads/1/3/4/4/134476812/vunezatulasot-nepakemawa-vuselifa.pdfIn PDF document text
    • https://cdn.sqhk.co/miloxuso/hdhfkHN/judagigew.pdfIn PDF document text
    • https://cdn.sqhk.co/wobimore/hhGajjt/video_downloader_chrome_extension.pdfIn PDF document text
    • https://cdn.sqhk.co/duzimisese/6AgVRif/crusader_kings_3_losing_battles.pdfIn PDF document text
    • https://nulixosur.weebly.com/uploads/1/3/4/3/134311840/e98fc60386506.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/rodakarugupoko/diane_stupar-hughes_age.pdfIn PDF document text
    • https://c78ffd2e-fc3d-4272-86ca-968d835fb7ad.filesusr.com/ugd/0f9ef0_e9950659a7ee45a2a415ac0d98bb564c.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/1051b84d-87e5-4421-abf4-4f5278d92ade/dell_t3500_power_supply_removal.pdfIn PDF document text
    • http://sixobujogek.rf.gd/ruvulegekazugaviposoveb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c0026ce-535c-429d-9b41-18484bcfa43f/mijuravofotapiguwak.pdfIn PDF document text
    • https://02687da8-bf2b-436b-a8ca-82c6e04513a5.filesusr.com/ugd/e48f8a_ebf2bd50b30e4664882dc58c94c89a5e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8113f1b0-72ae-4c25-8ca2-883d3174b159/84988710615.pdfIn PDF document text
    • http://tolimimagag.epizy.com/12117_county_road_excelsior_springs_mo.pdfIn PDF document text
    • https://3b044092-e341-4c69-a8e2-52b14fc1865f.filesusr.com/ugd/370021_9ed32f4afa4e466da173604ebfec9af0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wixanarer/aifmd_reporting_requirements_luxembourg.pdfIn PDF document text
    • https://s3.amazonaws.com/bipovoromoj/bosch_serie_8_dryer_not_drying.pdfIn PDF document text
    • https://3dd85f33-233b-4b3c-8e53-142bc8307eec.filesusr.com/ugd/8df890_f44f1b4ef3924654b614c18e6433d652.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a521af4d-1dff-4d5b-a670-0d8fff5d8cd0/what_does_609_mean_in_your_dreams.pdfIn PDF document text
    • https://84daacc9-7e90-4c5d-b1ed-526950900c49.filesusr.com/ugd/73f3b0_cdcd0f33125d407eb452dbd86d7a63c6.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae8ae431-9150-46ff-922a-b869f998edfd/99808053634.pdfIn PDF document text
    • https://s3.amazonaws.com/febopa/chiru_kannada_movie_audio_songs.pdfIn PDF document text
    • http://virilos.epizy.com/kitisewadamewikobewaxa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFAD 5068 bytes
SHA-256: a8b7b584242718230d7b00c1cf4562c88af5f17d8b01a710fb85f78b0379f53e
font_01_sfnt_off000100b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100B2 10496 bytes
SHA-256: 167755506528842ac74ea4d3c0cab5174e645dd72076a94b6ed1cdcca719142d
font_02_sfnt_off0001248f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1248F 4324 bytes
SHA-256: ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230

Open this report in the interactive analyzer, or submit your own file for analysis.