Malicious PDF — malware analysis report

Static analysis result for SHA-256 e80ae0ea9ca0e2bf…

MALICIOUS

PDF

273.3 KB Created: 2021-06-08 03:33:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 434b03eac95a5b1d9f3144d3ffcfa104 SHA-1: e00c6b61a777858221de1036a7837af67f724dd4 SHA-256: e80ae0ea9ca0e2bfe175157bb67d6132913ffe84f4ba021c7cea2274bae3231f
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics as malicious, including a brand impersonation for PayPal credential phishing. It contains embedded URLs that lead to external sites, one of which is a redirector to a PDF file hosted on weebly.com. The ML classifier and ClamAV detection further support its malicious nature. No scripts were extracted, but the presence of external links and the phishing lure indicate a credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6007

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://lakojelot.weebly.com/uploads/1/3/1/6/131637836/japuvifanenopowizun.pdf.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://catamma.ru/pbw?utm_term=hacks+para+1v1.lol+pc PDF link annotation
    • https://lakojelot.weebly.com/uploads/1/3/1/6/131637836/japuvifanenopowizun.pdfIn PDF document text
    • https://gapemudumowew.weebly.com/uploads/1/3/1/4/131437765/f6bc77cd36cf45d.pdfIn PDF document text
    • https://jokazetesolibut.weebly.com/uploads/1/3/5/3/135314514/1113734.pdfIn PDF document text
    • https://waniritapi.weebly.com/uploads/1/3/0/7/130739375/2166461.pdfIn PDF document text
    • https://didejigoximatex.weebly.com/uploads/1/3/1/0/131070501/8152810.pdfIn PDF document text
    • https://tumogifizutuvo.weebly.com/uploads/1/3/4/5/134527103/vawixazavalunev.pdfIn PDF document text
    • https://tonikajolokoge.weebly.com/uploads/1/3/0/8/130874266/a84be5de1c.pdfIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://nagomax.pbworks.com/w/file/fetch/144825852/ejercicios_de_matematicas_6_primaria_santillana_saber_hacer.pdfIn PDF document text
    • http://xelivolofuso.pbworks.com/w/file/fetch/144546249/cg_holi_song_dukalu_yadav_free_download_mp3.pdfIn PDF document text
    • http://giresizuloki.pbworks.com/w/file/fetch/144443352/turks_and_caicos_weather.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8fb7790c-bbd0-4f4a-8824-d29e50a6dd42/kumulak.pdfIn PDF document text
    • http://fadoposapat.pbworks.com/w/file/fetch/144579735/319.pdfIn PDF document text
    • http://xegosigex.pbworks.com/w/file/fetch/144685914/telugu_rockers_full_movie_free_download.pdfIn PDF document text
    • http://godekazonigi.pbworks.com/f/banovesowatoterixeropifip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ea9f42a-97bf-47cb-b5cd-0177a818e0b4/sweat_equity_contract_template.pdfIn PDF document text
    • http://nagaxop.pbworks.com/f/18978427424.pdfIn PDF document text
    • http://katexawa.pbworks.com/w/file/fetch/144683568/how_to_buy_penny_stocks_in_canada.pdfIn PDF document text
    • http://gezebal.pbworks.com/w/file/fetch/144738273/como_descobrir_a_senha_do_wifi_pelo_celular_-_j_conectado_iphone.pdfIn PDF document text
    • http://mujusevo.pbworks.com/w/file/fetch/144455931/93220382422.pdfIn PDF document text
    • http://sujagajo.pbworks.com/w/file/fetch/144732387/you_make_my_dream_come_true_quotes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd79f90c-85d5-4937-b68c-795435b6ae51/69744669276.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d055a11f-b4fc-4ac5-bdd7-0ea3928e9f48/batman_the_long_halloween_comic_for_sale.pdfIn PDF document text
    • http://wemekojezum.pbworks.com/w/file/fetch/144671172/how_do_you_write_a_report_in_english.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off0003d63f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3D63F 30288 bytes
SHA-256: 3b3b344169f4cd553d9c1c0712d632294ee6efa7cc3686caa6a85d805f147684
stream_009_off00040c79.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x40C79 14048 bytes
SHA-256: 69fd87473bd299f2b0d70c11706935e1fd89fc7e5ffdaa940b49e5fa42fa2dab
font_00_sfnt_off000237bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x237BC 89096 bytes
SHA-256: 0e3ff4a5f4c96728ef8fe5cb725219d209e3528053ef7e22e229670c5ee213fd
font_01_sfnt_off00033b45.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33B45 5096 bytes
SHA-256: e33a87f46eb90fd9e4aac57da6904adf8d304528f27704692095628f966a1b2d
font_02_sfnt_off00034cbc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x34CBC 17732 bytes
SHA-256: e9cfa0b3d217d338e52f5c0eb6afc52d64dab67a81def7b06f492c63907c6711
font_03_sfnt_off00037fb2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37FB2 32952 bytes
SHA-256: bf11acddad756dceb0d8d6d193922f1c573d771e88aa779fd234d86a4742ad9c

Open this report in the interactive analyzer, or submit your own file for analysis.