Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2208ca20da2c1b2…

MALICIOUS

PDF

73.6 KB Created: 2021-01-06 06:11:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 8d8c050719d2bf49ba26d9b0f5efccd6 SHA-1: b06bf5eff80fef98553730b8eb7c69c49b99d6e6 SHA-256: e2208ca20da2c1b2d82cac4b66fb58b764cb4afea8e9dd3b9ee0d114af0ebde8
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a suspicious domain, likely serving as a lure for malicious activity. The document body, though heavily obfuscated, suggests a 'worksheet' context, which is a common social engineering tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=blood+types+worksheet PDF link annotation
    • https://cdn.sqhk.co/gutemokerezo/s4ig9gj/xexulotizotikosifupuriko.pdfIn PDF document text
    • https://cdn.sqhk.co/farukisinu/4jcidgi/60401934125.pdfIn PDF document text
    • https://cdn.sqhk.co/dutebevon/ij8zihT/jarakuratabisewesedowitov.pdfIn PDF document text
    • https://cdn.sqhk.co/pivokazi/zjegeSf/tuwagojefujizu.pdfIn PDF document text
    • https://cdn.sqhk.co/zaperarori/ib57Jwg/stack_fall_guys_ball_physics.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tulosa/purigiwiluxak.pdfIn PDF document text
    • https://s3.amazonaws.com/gupuso/89112592979.pdfIn PDF document text
    • https://s3.amazonaws.com/sedowedi/blackwork_embroidery_patterns.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/367676ec-f332-410c-b07a-4e22ebc6aeb8/wofewa.pdfIn PDF document text
    • https://s3.amazonaws.com/poresi/banjara_song_video_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56f0976f-f29b-47ec-abc8-bc3b25eb3a2e/china_a_new_history.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f88d7741-969c-4577-85f2-1ce132368215/kejedonib.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/226f1a86-c90d-4fac-9445-c9d1d07a04f6/anchor_bolts_design_examples.pdfIn PDF document text
    • https://s3.amazonaws.com/sixolose/86252374393.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a89115c2-af51-49f3-9cca-d9d2c8aa9d21/amazon_driver_jobs_greensboro_nc.pdfIn PDF document text
    • https://s3.amazonaws.com/dinisemowoge/animate_cc_free_crack.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e46d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE46D 5144 bytes
SHA-256: 84abfc2baa5396df832f27fb9bb9d78a907630e2fc20f4df77d8ebcfba9b16ad
font_01_sfnt_off0000f604.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF604 10400 bytes
SHA-256: afb7fbe5f8eb4898a60bd4fca3e42856f6726f8afb9deae419116686c9fba302

Open this report in the interactive analyzer, or submit your own file for analysis.