Malicious PDF — malware analysis report

Static analysis result for SHA-256 05d5b295565e7232…

MALICIOUS

PDF

70.7 KB Created: 2021-06-13 00:49:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 3aebc9454fbe751f124a5afad489213a SHA-1: 1abc53292e447d47401062518dacb5fdc47c8c6f SHA-256: 05d5b295565e72325050973eaaac974a44c80bc10ca490a395fbc749c71f5447
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/pbw?utm_term=can+you+sell+the+ramp+car+in+gta+5 PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://sodopateduke.pbworks.com/w/file/fetch/144607215/how_to_use_perspective_procreate.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23e2a3b6-964a-4e74-a6b8-887cb5170704/14056390357.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/761961f2-a3c6-4424-accb-41a040d5be9c/68055808011.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a5876a7-643b-4eb5-8421-a6d2d321baf1/5705825525.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/96bb42ad-4413-4b04-a230-4432eaef3371/48742236693.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/562e9751-8fd9-4f44-9724-32c69d0c8f73/samipefip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36efac8d-1038-47ae-940f-c5c1fac19f6b/pemovorisu.pdfIn PDF document text
    • http://mifimoruzuwo.pbworks.com/w/file/fetch/144466989/what_are_the_colors_of_american_spirits.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/22db9d9d-c34c-46cf-8ed5-03a73bf51756/peppered_moth_simulation_worksheet_answer_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a264fc6a-7a3c-4879-a23f-a459db2676e8/the_joy_luck_club_by_amy_tan_movie.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b3850bc1-6b5d-44f6-a7c3-c4a40f8f2cb3/can_i_cancel_my_rental_agreement.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/982bdce0-8c4e-4941-a458-09f3b650e53a/tascam_dr-60d_mkii.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bcd0558b-506d-42ee-8fe9-ff1590a4e535/wasimimag.pdfIn PDF document text
    • http://tukosifana.pbworks.com/w/file/fetch/145028625/51362744889.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e7ff91c7-da87-406b-b91d-d59d7dad60cc/mackie_designs_cr1604_16-channel_mic_line_mixer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c687a082-1cc3-4f58-aea1-98e18632e51c/34355037497.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d6874c9-7f4d-4b4f-b445-cd4f46d32208/how_much_does_the_navy_pay_for_leave_days.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/13ece23c-0975-4771-89e4-8580c80a1a2f/19505188759.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d737.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD737 5480 bytes
SHA-256: 5961d63b8a4d7d558fc51be17f3c4c721f88183c4d258b059f7b55c70a7bef1a
font_01_sfnt_off0000e9b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9B8 10604 bytes
SHA-256: fec9adaeb2580f0698a3f6b389776b97da6c36b71a6e1b478da50fe9d7a03dc1

Open this report in the interactive analyzer, or submit your own file for analysis.