Malicious PDF — malware analysis report

Static analysis result for SHA-256 0865d9085ba47f63…

MALICIOUS

PDF

68.1 KB Created: 2021-06-07 02:00:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 01e87245e5cc94ea27b490a612a01f2c SHA-1: 1e2ec3612fa7bdeb45edf605f9b4a3d13ba2c67b SHA-256: 0865d9085ba47f63d0f1b70a96f3609d1f868c5a61a8b18b536e43c65ba7305f
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://smidgel.ru/pbw?utm_term=how+to+install+pavers+on+concrete PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4503874/normal_601cbe4b10dbf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405687/normal_6001007e4d3cb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451350/normal_605065d8b0a07.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417226/normal_5fc9ec92ee17a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421767/normal_60356f6cf210f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369143/normal_60b813c727778.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463277/normal_60489075bab0e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://munonoraze.pbworks.com/w/file/fetch/144608967/xasiboneretenuvipokanine.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f912fd9d-c9a7-4250-9382-123ff5b8e366/research_methods_in_psychology_3rd_edition_beth_morling.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/838b1fe5-5d2a-4a70-a6b1-c6d6e0e16393/phrasal_verbs_perfect_english_grammar.pdfIn PDF document text
    • http://pibadaro.pbworks.com/w/file/fetch/144582636/how_many_story_missions_are_there_in_rdr2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d04c95b2-bfd9-4ad0-b2da-31855cfdd259/tech_guns_mod_nuke.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e7a8b452-a509-4563-b9cd-d06b96b6a477/how_to_treat_cyst_acne_on_chin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9af041d-0b9f-4ff4-a8db-cb4b13309efe/el_hobbit_la_desolacin_de_smaug_online_castellano_hd.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ccf65d9f-8767-457c-8954-e9181511fde1/41987909940.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6c8a241-abcd-4071-a5c3-0a46cb14945e/zuxoruwemabopej.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0065b9b1-8f9f-42cd-8258-b5bb3da3bd01/heard_on_the_street_github.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b5909a1-4dde-4ec3-a1a6-8768639f4253/vuliwute.pdfIn PDF document text
    • http://dawijunegolo.pbworks.com/w/file/fetch/144576873/muzunejiwadavav.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/86523e68-b2c9-4031-9308-d5bdd53fccbe/medieval_cloak_pattern_with_hood.pdfIn PDF document text
    • http://katafuzum.pbworks.com/f/84697761085.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f0dfdaa-a831-4d19-8744-f7664af4c328/zubuxobusomev.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cf88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCF88 5040 bytes
SHA-256: 6cbc0db1392fd3b2c1446092b61d6467e15d4973833d33683f14d472be5fdeaf
font_01_sfnt_off0000e0d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE0D5 10064 bytes
SHA-256: 7fbeed33f9649409ebfcce8d97211cef49bf0b0392400f996a3fadc9500955fe

Open this report in the interactive analyzer, or submit your own file for analysis.