Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2fe5d9f89457bc5…

MALICIOUS

PDF

75.4 KB Created: 2021-06-05 15:27:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 4492f9a9ad8673f063ab400ea643496e SHA-1: c28d539206330bc6efa5bf1c1221bb68d82e35a4 SHA-256: e2fe5d9f89457bc5dc76aee284ea6971d865726d3fcd87dbfd9d8489240c7adb
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific ClamAV signature indicating it's a phishing trojan. An external URI pointing to 'irlanc.ru' was extracted, suggesting a phishing lure. The document body, though heavily obfuscated, contains metadata related to wkhtmltopdf and a date, indicating it was likely generated programmatically to present a deceptive summary.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9960

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/pbw?utm_term=summary+of+joey+pigza+swallowed+the+key PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4486221/normal_600322650d8fe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376357/normal_5fe7c3f2d607d.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4381340/normal_60b440290b4be.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369794/normal_603d224738bfc.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4488133/normal_60b612f03a856.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392659/normal_604f10001c0ff.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417519/normal_601468daa1cb0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480397/normal_5fd7cf5885190.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367286/normal_602e6f3ba5225.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413368/normal_602b45bdb4113.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379722/normal_603bc891aa00b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4496853/normal_5fcb31b83ebfb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501962/normal_600fa02daf202.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413978/normal_5fe9e00b4dac2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448750/normal_60537069cea37.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448126/normal_6010fc9f43df7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4422371/normal_60036176e4370.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425726/normal_5fcc9a8676a12.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://jowenoxo.pbworks.com/w/file/fetch/144550821/how_to_put_a_countdown_clock_on_powerpoint.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b71aef8e-f92b-4aa3-bac2-c8e2c6928868/rode_videomic_pro_plus_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/be9efe91-c2d3-4d16-8aca-66e36286a192/parallel_and_perpendicular_lines_worksheet_glencoe_algebra_1.pdfIn PDF document text
    • http://fokopaviwu.pbworks.com/w/file/fetch/144567090/mi_maestra_es_un_monstruo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c42d117f-3a37-487a-a609-571e0418d26b/toro_gts_6.5_clean_carburetor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9510ed2f-88c7-4497-a321-0d8e239f0b16/60843359727.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb4a15cc-faeb-4faa-97db-e76b0283ec65/jagagatiwavolik.pdfIn PDF document text
    • http://bukafag.pbworks.com/f/how_to_become_a_medicaid_transportation_provider_in_florida.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e785.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE785 5940 bytes
SHA-256: 496af6c0da68a08443b9b9bc498abee84e45d1f507242eb7aa3cac3fe47c6b3c
font_01_sfnt_off0000fbb5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBB5 10856 bytes
SHA-256: c30df3bc5e50750ce5d21ecb2f48a5e9bc8cb15d879fdd2544996ac123784077

Open this report in the interactive analyzer, or submit your own file for analysis.