Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d90a5e07f0fd9ff…

MALICIOUS

PDF

69.0 KB Created: 2020-11-28 16:41:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 0b295b87259d20b22c4495867feebc8f SHA-1: d37badd41b514b27fb4acf671b24b9eeba2f8e08 SHA-256: 0d90a5e07f0fd9ff945151371384a0b7b1579a14e632b0aeda26e12438ea1e51
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/strik?utm_term=how+long+are+soccer+games+in+world+cup PDF link annotation
    • https://mojivimimujovo.weebly.com/uploads/1/3/0/8/130874437/44d87feaf8ee.pdfIn PDF document text
    • https://komavumi.weebly.com/uploads/1/3/0/7/130738531/ginojazibevojujabof.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418777/normal_5f9a47672cd05.pdfIn PDF document text
    • https://vebeviwikime.weebly.com/uploads/1/3/4/3/134317270/texusizusuviwe-kaxotimupiv-nijowowisu-semewa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383446/normal_5f9150a933dd8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/487d3cb5-090f-4a8b-83df-a488dadf989c/8882998540.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dfb08af5-8c8c-442e-ac93-66a358a987f8/61249508217.pdfIn PDF document text
    • https://s3.amazonaws.com/gidibesuxi/mowifovimoxofikesonidurip.pdfIn PDF document text
    • https://s3.amazonaws.com/vuraradaso/fetitovi.pdfIn PDF document text
    • https://s3.amazonaws.com/firigugixujotov/xozumasipapozux.pdfIn PDF document text
    • https://s3.amazonaws.com/tutapaxi/34730305917.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e40f0c98-21c3-4f4b-afd3-a533c07c602b/factory_direct_wholesale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a49a64c-ba23-43ac-b70e-98d6788b67f7/vuwisumijowovozodejepa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f06579ac-b2ad-46d9-b96b-c1620b8204c1/gajamovaregovarejubipajol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a5fbc0d-cc78-4023-bdbc-be8de4ca6c71/algebra_2_glencoe_workbook_answers.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD0FF 5448 bytes
SHA-256: 9e6b05cf06d6d95cb352906c71ddb825df4f4efdeba1fb73fbc78f11e6ddc4ba
font_01_sfnt_off0000e383.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE383 10448 bytes
SHA-256: b89b6892c99072b5f64700d2e9ccc9516511528a344e8fae1ce7efe7cf8e848f

Open this report in the interactive analyzer, or submit your own file for analysis.