Malicious PDF — malware analysis report

Static analysis result for SHA-256 d35be3029bda5bbd…

MALICIOUS

PDF

76.4 KB Created: 2021-04-01 13:25:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-25
MD5: e0316fc3646e4005b06ddc57d504950e SHA-1: 88dedb03fd41fd77d6b8b428a6239e0e985c88c5 SHA-256: d35be3029bda5bbd1a50579b89889a8b31dde1f99e0500bb76c916f1918ce2f4
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing lure, using an image to link to an SEO redirector. The embedded URL points to a domain that is likely malicious, and the document body, though heavily obfuscated, appears to contain a fabricated news headline to entice clicks. The ML classifier and ClamAV detection strongly support the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=nbc+news+reporter+killed+in+syria PDF link annotation
    • http://gprofights.ru/hotels_over_paradise_island_bahamasa9gw5.pdfIn PDF document text
    • http://befigter.xyz/hl-3170cdw_wireless_setup_macq6j3y.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463551/normal_60597b601f3ce.pdfIn PDF document text
    • http://buytoday.cc/john_proctor_quotes_about_reputationzk2lr.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4380854/normal_5fdf790b97dc8.pdfIn PDF document text
    • http://ranking-se.com/gumefobumudelukenopabld3yr.pdfIn PDF document text
    • http://d-youtube.com/347123212501tk78.pdfIn PDF document text
    • http://ogranicbio.space/assistant_extra_light_fontamc8u.pdfIn PDF document text
    • http://menformula.xyz/litikeligoxqrg4i.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382406/normal_600db4d9c96d6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405419/normal_5fe309c24312a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/viwoxuz/sapefovebazip.pdfIn PDF document text
    • https://f4e740b0-69d0-4d5c-a0c7-362dc6b2ad6d.filesusr.com/ugd/0356fc_273e2ddfb09742a6992b1d737cfccb3e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gekixadonuru/nifipugenetal.pdfIn PDF document text
    • https://s3.amazonaws.com/dazifozixawus/hindi_grammar_worksheets_for_class_5_icse.pdfIn PDF document text
    • https://s3.amazonaws.com/likerajatob/46488753829.pdfIn PDF document text
    • https://s3.amazonaws.com/dazovosugev/whirlpool_duet_front_load_washer_clean_cycle.pdfIn PDF document text
    • https://1c985592-4fe2-425a-b8d2-7dc24782370c.filesusr.com/ugd/a13bc2_57557f9a72024326ac728090b2ca4e04.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/forupokisip/angular_template_example_plunker.pdfIn PDF document text
    • https://s3.amazonaws.com/rutufokedizon/fernando_alonso_dakar_2021.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecbc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECBC 5432 bytes
SHA-256: 871ae0b2995b12821bc0d80357e080e0bd8f6b48aa9cc0b2ec754b319ef7c1b4
font_01_sfnt_off0000ff5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF5C 11160 bytes
SHA-256: 7d10a1a57bae5457bc43064d5205033e476595ca871f0d7710b9be558dca846e

Open this report in the interactive analyzer, or submit your own file for analysis.