Malicious PDF — malware analysis report

Static analysis result for SHA-256 cfee7635edf9d81e…

MALICIOUS

PDF

79.2 KB Created: 2021-06-06 23:52:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 8ed00eddb8664dfe940000aa9e9189be SHA-1: 52bd9d70d11039a0b4fc2c0c38e61fe68c2c50a2 SHA-256: cfee7635edf9d81e761be07a4831ad1a638ac5d0baf552b0eee66c4db095f169
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a suspicious domain, likely intended to host a malicious payload or redirect to a phishing site. The document body, though heavily obfuscated, suggests a lure related to a test document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://synerhu.ru/pbw?utm_term=9.+s%25C4%25B1n%25C4%25B1f+biyoloji+inorganik+bile%25C5%259Fikler+test+%25C3%25A7%25C3%25B6z PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4485929/normal_5ff1cb4763306.pdfIn PDF document text
    • https://zoxanomo.weebly.com/uploads/1/3/1/1/131163640/8827436.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465007/normal_6023f5cadaad8.pdfIn PDF document text
    • https://fokorakadugapo.weebly.com/uploads/1/3/4/4/134444193/puwolopubopajog-boxegekovuvo.pdfIn PDF document text
    • https://fakibugopozap.weebly.com/uploads/1/3/2/7/132712115/2457040.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4483589/normal_5ffea0831da32.pdfIn PDF document text
    • https://kigotofu.weebly.com/uploads/1/3/5/3/135323523/a5046cdb8be9c65.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4496582/normal_6000f5daf316b.pdfIn PDF document text
    • https://zowatiloni.weebly.com/uploads/1/3/0/7/130739934/ae76f.pdfIn PDF document text
    • https://tuxenovizomojow.weebly.com/uploads/1/3/7/5/137516496/370689.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408324/normal_6015d8dcb93d1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4420586/normal_5fc92c0af3f9d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474759/normal_5fcf11a57f308.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4493867/normal_6013ec2b4e44b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366325/normal_605ee8dbcef23.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370089/normal_5fd7c033325bd.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9cbab15d-5f02-4003-a294-202991a850ad/netflix_altered_carbon_reviews.pdfIn PDF document text
    • http://siwuromo.pbworks.com/w/file/fetch/144561273/what_is_ashab_e_kahf_in_urdu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64e45f70-ed75-44de-ad62-cd41fc11ae1d/.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf20920d-6e61-4d42-bb39-91a2f9804d66/45244085694.pdfIn PDF document text
    • http://ziduzobif.pbworks.com/w/file/fetch/144608592/62052723345.pdfIn PDF document text
    • http://jilawuxifi.pbworks.com/w/file/fetch/144580470/facebook_login_code_not_received.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6A3 6060 bytes
SHA-256: 07ffcd9cec2e804f35405ae42e2bf792fade25026382699d7b34c7553c500030
font_01_sfnt_off0000ea88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA88 11504 bytes
SHA-256: 1cdece0c8c4f637f24a7d95ab0561d7b8bb010457b9b32a0e3c5d221c28e1745
font_02_sfnt_off00010f76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F76 18324 bytes
SHA-256: 5d590d31eb943771c7debbaef2cf2bc3eddb6746fc4965e770d441f58420151b

Open this report in the interactive analyzer, or submit your own file for analysis.