Malicious PDF — malware analysis report

Static analysis result for SHA-256 00bc83cd02670bf2…

MALICIOUS

PDF

91.7 KB Created: 2021-06-12 13:43:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 94a58090ab040c58fc695fe6b67ee354 SHA-1: b105525c00c8c1a85aa408575872a07ee7952897 SHA-256: 00bc83cd02670bf2a903f7c018a4248d61a855e57f733bb45eec98cda8abf1a2
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that directs users to a suspicious domain, likely for phishing purposes. While no scripts were explicitly extracted, the PDF structure and embedded URI heuristic suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/pbw?utm_term=a+hat+in+time+relic+locations PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4387918/normal_60348454952cd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4447093/normal_5fef85952adf4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387582/normal_5ff293ee1b4c5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390642/normal_6014952b0d1b2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454438/normal_5ffa6a8ca39cf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482636/normal_5febdcb74e47c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444623/normal_5fd7eb5ca3799.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393506/normal_603aeb269d11a.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4448727/normal_60b211ab5f4d0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486763/normal_6062efdd2f436.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4418558/normal_5fdff1621550b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://tujedet.pbworks.com/f/super_mario_bros_ds_rom_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8116397c-2edc-4a8d-99bf-07aab11695de/frank_morgan_geometric_measure_theory.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/713bc358-fbe4-455e-8476-636c531781fe/17131232093.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4373207-f810-4743-89bc-a8e65bf46562/how_to_replace_kwikset_battery.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2f231d3-b03d-4ad7-bfa5-8670c574250a/baile_pelea_de_gallos_de_aguascalientes_wikipedia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/797460eb-26de-427c-a64f-34962d311cb5/descargar_pokemon_blanco_2_para_emulador_nds.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/898e1a5d-6556-47b2-819f-ab7beb887b4b/casella_and_berger_statistical_inference_solutions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a1013538-85fb-46e7-b132-dd04d3283c72/13307045400.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c68c8e16-cae0-4ccb-b82c-cac3dd650ba9/bollywood_movies_hd_archives_bolly4u.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5644f2ec-83ec-4071-b3d3-7dc237c73ccb/63371594584.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27c04579-dd2d-420a-8538-2d96c61e0586/zapovuwokefedubitiwavoxax.pdfIn PDF document text
    • http://gepefupugalu.pbworks.com/w/file/fetch/144495948/fact_and_opinion_examples_high_school.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012b20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12B20 5028 bytes
SHA-256: 8ff575c0a2ab76fbbe8b0632b53cd6c5a2df8d796ab412408698952e9b3bc5b1
font_01_sfnt_off00013c08.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13C08 10848 bytes
SHA-256: 65e7e29780c30a8c8d8d180def3e8c9800fd4aac7c253488cbfca8cd1be89f3d

Open this report in the interactive analyzer, or submit your own file for analysis.