Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d513fcbf3363af0…

MALICIOUS

PDF

75.4 KB Created: 2021-03-26 10:23:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 89d65c43c5ae1fe1755761c75684cfca SHA-1: 106f2ee88176b278856c65d574a8cd98e9d5ba62 SHA-256: 0d513fcbf3363af0349efdc6ecce968934a41123b38aa83de454e3e633ffec53
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=how+to+become+acio+in+ib+quora PDF link annotation
    • http://hushseo.online/which_roku_supports_screen_mirroringyex2a.pdfIn PDF document text
    • http://winoraama.space/sojukoxegadinufsumy.pdfIn PDF document text
    • http://bewizevamud.iblogger.org/best_call_and_sms_forwarding_app_android.pdfIn PDF document text
    • http://1gusevshop.space/temebuguweceus1.pdfIn PDF document text
    • http://stylecurtains.com/pajezakekmz6lo.pdfIn PDF document text
    • http://medgaj.com/c_standardpy441.pdfIn PDF document text
    • http://ledimpress.biz/lufofenowebteu36.pdfIn PDF document text
    • http://help-violation.com/cambridge_math_book_grade_10zpqmb.pdfIn PDF document text
    • http://befigter.xyz/computer_coding_classes_for_adults_near_mev63rq.pdfIn PDF document text
    • http://vadusulu.iblogger.org/simple_chinese_dragon_mask_template.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/bab7bed6-3e69-4f66-b578-7891b4e6a5c5/arrl_ham_radio_license_manual_4th_edition_download.pdfIn PDF document text
    • https://c8a164a7-2549-4056-b209-d27d417f800b.filesusr.com/ugd/136d3d_69ba410cb8874afca0103678e5c1f3ee.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/radubozufiwo/fadebopi.pdfIn PDF document text
    • https://s3.amazonaws.com/damerirazib/97790897493.pdfIn PDF document text
    • https://s3.amazonaws.com/bevarolimesale/waitress_resume_templates.pdfIn PDF document text
    • https://20128683-61eb-4207-b985-d468b1a81fea.filesusr.com/ugd/0049ca_5d1af44d11974f78bebca2d959dd11d3.pdf?index=trueIn PDF document text
    • http://viminug.epizy.com/decolonizing_the_indian_mind_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9775753e-028b-45a7-8138-514836e31af6/canon_pixma_mx300_scanner_driver_download.pdfIn PDF document text
    • http://sogaviwezed.rf.gd/icarsoft_i980_software.pdfIn PDF document text
    • https://s3.amazonaws.com/mevuzokekenojab/creo_parametric_6._0.pdfIn PDF document text
    • https://84daacc9-7e90-4c5d-b1ed-526950900c49.filesusr.com/ugd/73f3b0_1a639e0011784849a5a0b4a197c333ea.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tejuvonixag/sukugokodef.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd8bded8-84be-4a5e-a11c-31159f59cf7f/47776765039.pdfIn PDF document text
    • http://jojanotesejivi.epizy.com/puzozewujojugujugubam.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eadc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEADC 5052 bytes
SHA-256: da3da1712862b81a17c1de37292b668a43e4761147a85f4ea54fdcf130a91f5c
font_01_sfnt_off0000fc07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC07 10720 bytes
SHA-256: 631f04ea0dd0cd7dff9e5a662d3c8b87c3bc59a03c9b7d29b5838de3dbec6bce

Open this report in the interactive analyzer, or submit your own file for analysis.