Malicious PDF — malware analysis report

Static analysis result for SHA-256 01234ddf6f736eb5…

MALICIOUS

PDF

80.2 KB Created: 2021-05-28 21:10:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: b1f88ad7b5dffb2705e3302d3669296e SHA-1: bee2dbf86889aa3e876582e4ddc19240be9aa9dc SHA-256: 01234ddf6f736eb57a0e229544d93b72a7cbf79d79d50ab415a52000b1873777
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=company+tax+returns+format+for+accounts+forming PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4413978/normal_60212cd9ac7b6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4501989/normal_600634dabc0b1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459482/normal_5fe902f9c7266.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370265/normal_600f3606a6c90.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444623/normal_600e0089756fc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408703/normal_603c2b2f334eb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421218/normal_5fc7bde4ce259.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481988/normal_604012a4659eb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459058/normal_6068b6554810e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366384/normal_602056d6a191a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475985/normal_6037135f05f49.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489041/normal_605df7bcac6f3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/06a76eed-3df1-48f2-85d5-59e54e809cef/ruger_yukon_air_rifle_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/089e4990-6ac5-47cf-bdbc-f9e7b9feee6c/fegawapalifegovoduf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42f8328b-1f3d-4501-a4be-134bf7fa292b/verb_to_be_and_present_simple_exercises.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/29c0dd94-2b83-4e0b-97d4-6d6d4e7be430/how_to_calculate_army_reserve_points.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fea0d142-a0eb-47f1-aa87-44ceb5ebfb99/5656297020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/681a41dd-5b4c-41d4-b2e8-23b63f7a741c/house_of_leaves_detailed_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c9ff770-8295-4e39-9f29-1757398ee3c3/landforms_and_changes_worksheet_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11dbbc74-da08-4020-9923-78de84eef66c/insurgent_book_sparknotes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fe398776-3175-4cae-9cc8-ab25f96ab924/puwilovitagudukufo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a5b0104-c3b8-40f9-8e48-ddc4572471fa/36003035661.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f3af2f0-8a17-43f9-a44c-6e2084d923c7/galaxy_attack_alien_shooter_codes.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBEC 5376 bytes
SHA-256: 3faf4cbd84b850b4b4c7bc159cdcb900ef9d9b0dbadd0a04c147029908b960e2
font_01_sfnt_off00010e32.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E32 10848 bytes
SHA-256: 6923370885f5ddf5b92cac99385e1fb599fb07563824e937179deb49c5176d81

Open this report in the interactive analyzer, or submit your own file for analysis.