Malicious PDF — malware analysis report

Static analysis result for SHA-256 f1e651d2b4caf903…

MALICIOUS

PDF

75.7 KB Created: 2021-04-14 12:22:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cc472e2d45c2f620a8e18effb66a336c SHA-1: 83ec1741dc34b191b5f7a5b7972819715f461a6b SHA-256: f1e651d2b4caf903528ac037a32875152702596ac0d658102ec2b9e341f418ea
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a lure related to updating Apple Airport Express, combined with heuristics indicating an advance-fee scam and ML classification flagging it as malicious. The embedded URL points to a suspicious domain, likely serving as a phishing or malware distribution point. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest it's designed to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=how+do+i+update+my+apple+airport+express
    • http://dikuziropuviv.22web.org/wahl_clipper_replacement_blades_near_me.pdf
    • https://cdn-cms.f-static.net/uploads/4390637/normal_600bef3e71cca.pdf
    • https://cdn-cms.f-static.net/uploads/4472763/normal_5fd3a614b4eba.pdf
    • https://static.s123-cdn-static.com/uploads/4448339/normal_5fdfdae1e6bcd.pdf
    • https://static.s123-cdn-static.com/uploads/4461219/normal_5fff99f192180.pdf
    • https://static.s123-cdn-static.com/uploads/4366961/normal_5fca834fa9c0d.pdf
    • https://cdn-cms.f-static.net/uploads/4385620/normal_605b6c5c2015b.pdf
    • http://rorureferujuraf.22web.org/powerpoint_templates_new_technology.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://37bcb4aa-7747-4ff6-a352-0e22bf983c21.filesusr.com/ugd/4393d3_6f23360688ec4b238e3e8f4e14b630b4.pdf?index=true
    • http://pevutedijubixit.epizy.com/how_to_get_a_cdl_learners_permit_in_nc.pdf
    • https://91506351-5699-48ce-85e7-8e7d071f4e87.filesusr.com/ugd/d775a9_7e87795519f147a8978c6ffe45075ac7.pdf?index=true
    • http://pewafup.epizy.com/rimas_y_leyendas_bcquer.pdf
    • https://95c758d6-fd33-43c6-b5d0-f1f55e07e946.filesusr.com/ugd/cb0188_a8b395ea72eb4d25b8cf1e0740148705.pdf?index=true
    • http://weniled.epizy.com/managing_oneself_peter_drucker_download.pdf
    • https://8607b5f8-c2b2-49b7-a314-b17bd4efff40.filesusr.com/ugd/d99252_155025ae07d24d54a10d964a95977efb.pdf?index=true
    • https://s3.amazonaws.com/pexodugosa/become_tour_guide_edinburgh.pdf
    • http://xaninulutinofeg.rf.gd/geladeira_brastemp_frost_free_ative_manual.pdf
    • https://s3.amazonaws.com/nuselufuzo/mordegon_second_form.pdf
    • http://bevavotubuzepu.rf.gd/roland_barthes_a_lover_s_discourse_fragments.pdf
    • http://sorajapiliwixod.rf.gd/otras_formas_de_comunicacion_no_verbal.pdf
    • http://bidavavaxekize.epizy.com/lipid_profile_normal_values_chart.pdf
    • https://54a0e2cb-796f-4f80-9aaf-d11633176b06.filesusr.com/ugd/b0c554_d1ef18678ea74235b47185dd2fb87995.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e970.bin
2d173cb794e18902466698af0f7448956e9499bc8cf2ae72e6292b68763f71dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE970 5328 bytes
font_01_sfnt_off0000fb8f.bin
449fcf19d1b59209d6b65851fa5c8fd4e37fa0d62fa6368602e62c83054814e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB8F 11012 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.