Malicious PDF — malware analysis report

Static analysis result for SHA-256 cff8ef52d7170d11…

MALICIOUS

PDF

170.1 KB Created: 2021-03-23 21:26:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20
MD5: f3f025cddba8fc270845e6409586d1d9 SHA-1: c7691f508eb9a0e04fafd387e04ede408b5f57c1 SHA-256: cff8ef52d7170d119a0089a8994e5d46064100f08a3c6e05c15ed6339a6e7a64
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains a lure for a 'free download' via an embedded link. This link points to a suspicious domain, and the ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. No scripts were extracted, but the PDF structure itself facilitates the malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9973

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=precalculus+pdf+grade+11+teachers+guide PDF link annotation
    • http://lamisorosasam.mywebcommunity.org/14829178387.pdfIn PDF document text
    • http://tebafurunaxinuj.getenjoyment.net/pibax.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://d4996ccb-aecf-47c4-aab6-3c4fe022e1b7.filesusr.com/ugd/b7ed05_ff15e462994a42c192188fd25a1b27d6.pdf?index=trueIn PDF document text
    • https://86146b48-cf95-488a-b5a0-22832f4589a6.filesusr.com/ugd/3b4eee_db884846954a4aacbfac73e33bd6abb9.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bokexizometun/14733818537.pdfIn PDF document text
    • https://s3.amazonaws.com/vonuxagupeduze/63573338612.pdfIn PDF document text
    • https://s3.amazonaws.com/gopuze/sword_art_online_integral_factor_crafting_guide.pdfIn PDF document text
    • https://9b704b87-3668-414c-a24e-b30400fe0e33.filesusr.com/ugd/51c472_cd883258881c46b7a23f42381b688c50.pdf?index=trueIn PDF document text
    • https://b24182fa-1fee-416c-9f57-41d8a36573e1.filesusr.com/ugd/1cc367_9a785a2650a141db8b967e129851f812.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fekazudabo/academic_performance_of_students_athletes.pdfIn PDF document text
    • https://edefa294-c65c-46c5-840b-8a4669b9fdfe.filesusr.com/ugd/e4a001_6ed3654478cc4daf9310d6d02a6130ae.pdf?index=trueIn PDF document text
    • https://e691ad07-92dc-45fa-af10-8929b4045ede.filesusr.com/ugd/87b9a8_2191d089c5e748918b43628e79178cba.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/rijaliwiguvex/wusetebifem.pdfIn PDF document text
    • https://ed0f7819-48b4-4c0d-9119-93de03d81b9c.filesusr.com/ugd/e481ce_63d727176a1f40f2a0ddc66db7866e11.pdf?index=trueIn PDF document text
    • https://67d298e0-85f4-4ad4-bf36-e1ac857e42fc.filesusr.com/ugd/b6bf5b_15d6cdace56f4307b96f10e0602e1071.pdf?index=trueIn PDF document text
    • https://eee5dff6-7331-416e-acdf-593d0c386862.filesusr.com/ugd/21e9e0_be7313ccb15148878788251dae884f9d.pdf?index=trueIn PDF document text
    • https://e0f910ba-f4aa-4d6b-87f6-24d78cda99ab.filesusr.com/ugd/cc15ef_0158bdc7cf1d42f2a63247e43a22512b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gomaxod/54006248669.pdfIn PDF document text
    • https://d046670e-94b8-4ea2-8efc-69fca9b502c9.filesusr.com/ugd/c0b427_6dd8ea9042e14fddbce84b462f194410.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/patotale/how_can_i_learn_business_communication.pdfIn PDF document text
    • https://9dc8676a-0e58-44ee-a512-e339c7094702.filesusr.com/ugd/7c0652_03874f15e58745a994ebca8630afdce6.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00023267.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23267 6936 bytes
SHA-256: 71e23c4d3f16e300947e663f2e8eef73e2c7a0249a35aa1bb21e8e3a9af71c89
font_01_sfnt_off00024404.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24404 5468 bytes
SHA-256: c6d626aaa78b76f51a4cf8b45666cd84fc2f04045a54ba4fd8c9205ca90382fb
font_02_sfnt_off0002569d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2569D 12536 bytes
SHA-256: e773d75d127a0aa701afc20a69b140d0677f15c804dc4b8cddc10649dfbd1a50
font_03_sfnt_off0002813f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2813F 16456 bytes
SHA-256: 27a865a996b67005427603a34eefae18810bdb035b662ee602c2916a7fb65a0b

Open this report in the interactive analyzer, or submit your own file for analysis.