Malicious PDF — malware analysis report

Static analysis result for SHA-256 f99d07ba5038f4a4…

MALICIOUS

PDF

114.6 KB Created: 2021-02-13 12:44:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 5b278f359ef37c49f8eb9116a0668651 SHA-1: 1ce91caccc603fbf0ac95c2437aa747a519b128c SHA-256: f99d07ba5038f4a49673d98cdf86f32a7b98f23abac1364ac5cac0fc4bbdcdba
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, identified as a potential phishing or malware distribution lure. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site for further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/wix?keyword=worksheet+molecular+and+ionic+equations PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4416495/normal_601dc084544d2.pdfIn PDF document text
    • https://cdn.sqhk.co/midipumep/FharB3Y/58896900962.pdfIn PDF document text
    • https://cdn.sqhk.co/tazuxalana/gejfrib/what_do_crows_eat_in_the_lawn.pdfIn PDF document text
    • https://cdn.sqhk.co/wujugojuse/bOKJsjf/nalawezinowurovixul.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447434/normal_601f8f37733c5.pdfIn PDF document text
    • https://cdn.sqhk.co/jezofadu/Ur7ggcA/escape_the_prison_walkthrough.pdfIn PDF document text
    • https://cdn.sqhk.co/jivonotiso/dhjgDge/44704129145.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366350/normal_5fdd67da5ae9f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384642/normal_601b504c65d69.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365656/normal_6001d6b1dd96e.pdfIn PDF document text
    • https://cdn.sqhk.co/fudimesa/jd1hgpR/circus_tightrope_for_sale.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/betefowubevat/xenuluso.pdfIn PDF document text
    • https://s3.amazonaws.com/jeduzizonox/android_tutorial_java.pdfIn PDF document text
    • https://s3.amazonaws.com/gumagabu/kutakuze.pdfIn PDF document text
    • https://s3.amazonaws.com/sefabe/anlage_av_er_2017.pdfIn PDF document text
    • https://s3.amazonaws.com/bubisifapagefe/73940984581.pdfIn PDF document text
    • https://s3.amazonaws.com/xabalaru/use_of_pesticides.pdfIn PDF document text
    • https://s3.amazonaws.com/fasudikek/tomcat_application_server_free.pdfIn PDF document text
    • https://s3.amazonaws.com/vapelurowar/tikow.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013d3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13D3F 3076 bytes
SHA-256: b7e777e8becc0a2a5adbfaf999bff658743299c70cd436f3683e1ea5129a8da7
font_01_sfnt_off00014848.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14848 5384 bytes
SHA-256: 8295cdde1936b87ad033a5d749acf07872f6a8e349c6687943f4d41e1f282edf
font_02_sfnt_off00015a74.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15A74 25568 bytes
SHA-256: 17d450b27e51eb5aa6aa8d79e68cad15d02d1478d4919687e76e85322d088605
font_03_sfnt_off0001a631.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A631 16340 bytes
SHA-256: cec49a9f161b979f1bb7599a6dc3721bd1f4a57fc0b76d5316a1d5ea5f637cb6

Open this report in the interactive analyzer, or submit your own file for analysis.