Malicious PDF — malware analysis report

Static analysis result for SHA-256 cea1c901825f0019…

MALICIOUS

PDF

89.9 KB Created: 2021-04-03 00:52:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6ce9d531dd5fafa66f38adae17f88def SHA-1: 3c5e8ee60a84b195380af731cd3220ccc75afd31 SHA-256: cea1c901825f001952b7d43ea027125f08b5ded8b877489752d2adbd3622fa7e
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic firing for ClamAV detection. An external URI heuristic points to a suspicious URL, 'https://xezojetit.ru/award?keyword=blunt+ends+and+sticky+ends+pdf', which is likely used for phishing or to serve a secondary payload. The document body is heavily obfuscated and unreadable, but the presence of embedded URLs and the overall detection suggest a malicious intent, possibly related to phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=blunt+ends+and+sticky+ends+pdf PDF link annotation
    • http://creamwalls.online/xidogafoxupaj3vitb.pdfIn PDF document text
    • http://nnorm-id.com/93778179359lwqbm.pdfIn PDF document text
    • http://mx50off.pro/118653860844emkr.pdfIn PDF document text
    • http://center-about.com/hyundai_elantra_2017_service_manual83k0l.pdfIn PDF document text
    • http://a1metromovers.com/how_to_use_fagor_pressure_cooker_steamer_basketpl7r4.pdfIn PDF document text
    • http://tonagruz.ru/what_is_the_average_salary_for_a_mechanical_engineer_in_canadarwcx7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/kakekojezutok/64672477809.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2cdf716d-6d91-4983-b465-d72e13c3321b/73627966027.pdfIn PDF document text
    • https://s3.amazonaws.com/solonebosop/angry_neighbor_2._3_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ffa841cd-3d18-4a21-9678-9cc58459ea9c/do_natives_have_to_pay_taxes.pdfIn PDF document text
    • https://s3.amazonaws.com/wemazun/honda_excell_vr2522_owner_s_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e19e717b-649e-42d9-8245-3770db6f72e4/motorola_t325_bluetooth_pairing_instructions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1eceea3a-3ea9-4f76-a82c-026bed2903e6/how_to_calibrate_vizio_70_inch_tv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a3f36fd-baf2-4c59-b416-e96f9d8ce270/common_phrasal_verbs_list_with_examples_and_meaning.pdfIn PDF document text
    • https://s3.amazonaws.com/lemerisinivum/vomugutewarosidefexumiwev.pdfIn PDF document text
    • https://s3.amazonaws.com/vezumobigodub/iphone_x_camera_filters_for_android.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6710eb02-b15a-4c32-b783-9a6d9d4c854b/cuales_son_los_pasos_de_la_iglesia_catolica.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e8ac4501-8ba4-439c-9d1c-e26f610f2bf6/ps4_gold_headset_usb_stick.pdfIn PDF document text
    • https://s3.amazonaws.com/gagagakigibapo/mini_dv_tape_converter_to_computer.pdfIn PDF document text
    • https://s3.amazonaws.com/daxemo/avery_template_5195_measurements.pdfIn PDF document text
    • https://s3.amazonaws.com/vitelitubovuluj/80932360470.pdfIn PDF document text
    • https://s3.amazonaws.com/mejawiwomak/investment_analysis_mba_project_report.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20d9ad31-cc0a-496b-b371-4bd5e29e6614/31800275591.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011367.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11367 5040 bytes
SHA-256: fba8f274eccb48483014a4ac0aa5eebfcd9b5e76c7b474f8d06d7d17bc35a38d
font_01_sfnt_off000124ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124AB 11556 bytes
SHA-256: 8cca5b790ae9b14a975a7bb7d6b64fb35aaf296aac9cbd8b9aa904b3312e3be1
font_02_sfnt_off00014c00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14C00 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.