Malicious PDF — malware analysis report

Static analysis result for SHA-256 cee6269c81483666…

MALICIOUS

PDF

79.2 KB Created: 2021-03-30 06:54:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: c5b9268d38daeac60270cee54cdcc851 SHA-1: 54d6510192d00251102367c496a3a8fbb04c954f SHA-256: cee6269c814836669cd26723694983158c837bdb2fb39dfd4c575dacdd9c3d37
116 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a callback-phone (TOAD) lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=netspend+document+department PDF link annotation
    • http://carinsusa.info/spectrum_math_workbook_grade_8_free92cvz.pdfIn PDF document text
    • http://xelipev.22web.org/kipulaselujixeboxi.pdfIn PDF document text
    • http://palitra-cveta.ru/vcenter_server_appliance_ovf1q6df.pdfIn PDF document text
    • http://senteber.site/95576010852i98c6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/972fdc99-0dbf-4b28-bc03-d8bc2a42e05a/52614250357.pdfIn PDF document text
    • https://s3.amazonaws.com/fedure/openoffice_insert_equation_editor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b7bf734e-e4f5-445a-9f0d-0a1d856789fa/59274435889.pdfIn PDF document text
    • https://s3.amazonaws.com/nuruvapozixix/scotsman_guide_top_loan_originators.pdfIn PDF document text
    • https://s3.amazonaws.com/jefobexapulow/compressor_inlet_guide_vane_design.pdfIn PDF document text
    • https://s3.amazonaws.com/zowibatev/83041626460.pdfIn PDF document text
    • https://s3.amazonaws.com/gidibesuxi/93187346131.pdfIn PDF document text
    • https://s3.amazonaws.com/xamapebonijos/14217471768.pdfIn PDF document text
    • https://s3.amazonaws.com/zisulamisozoto/repuvaginunaluxetugixow.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f93e89a-af69-4828-9495-6eec33d545b0/what_does_self-defeating_mean_to_you.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60335005-fdee-4249-9705-146c8fcb323d/27502320053.pdfIn PDF document text
    • http://dilowopuvuzi.rf.gd/56091146228.pdfIn PDF document text
    • https://s3.amazonaws.com/rubidokezive/antivirus_protection_for_windows_10.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/237fd9e8-8673-4b64-b272-01c39e440145/can_you_get_into_law_school_with_a_d_on_your_transcript.pdfIn PDF document text
    • https://s3.amazonaws.com/tapelu/what_to_the_slave_is_the_4th_of_july_full_speech.pdfIn PDF document text
    • https://s3.amazonaws.com/fizufapu/fajanivemawufimij.pdfIn PDF document text
    • https://s3.amazonaws.com/fadadedezeker/daduboputizagajezu.pdfIn PDF document text
    • https://s3.amazonaws.com/xamibebulosaxug/bomb_squad_toggle_mod_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/guwutivupudutu/what_is_a_good_branding_statement_for_a_resume.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f3fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3FC 5156 bytes
SHA-256: 1fddd29666bf8c21e98838dc6e8501ef0c0bcc3679788529cd1990cbe62333e7
font_01_sfnt_off0001056e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1056E 11892 bytes
SHA-256: 6135262031b6ef3acf712892baf8c2833912cdef6c9d901563ef523d2f2e2cd7

Open this report in the interactive analyzer, or submit your own file for analysis.