Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e8c5e2323acc5b2…

MALICIOUS

PDF

112.1 KB Created: 2020-12-20 04:21:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 60fab9e6125d101976f9ada922931fc7 SHA-1: 4fbe476f5e96548fd1143ec31f6e7c681487ff2a SHA-256: 0e8c5e2323acc5b2ef8e0af52a9711c19f53600a43985721e6c6adb97ca1d36e
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=circles+tangents+arcs+and+chords+worksheet PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4374518/normal_5fb57d53124d3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369502/normal_5f8f5a9b02cfb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wemazun/ribigirawadum.pdfIn PDF document text
    • https://s3.amazonaws.com/negonanopix/logical_aptitude_questions_and_answers_for_freshers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a5eeb8b-015c-4181-9f5b-22711c1b9626/blue_spotted_salamander_wisconsin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0bc81aa9-9b53-4228-aec2-19dec1230ef6/7880872898.pdfIn PDF document text
    • https://s3.amazonaws.com/fonibinaraj/bonetale_android.pdfIn PDF document text
    • https://s3.amazonaws.com/lanaladu/adsorption_et_absorption.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d933bae9-c7cb-4bc2-95d5-ce9a3908122e/mark_wayne_mcginnis_author.pdfIn PDF document text
    • https://s3.amazonaws.com/zazelujeju/luzusudewugaduko.pdfIn PDF document text
    • https://s3.amazonaws.com/datarofapakil/tigexusinosipevewexogij.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc11cf00a2757459be424fe/t/5fcfed61747f573790d1d172/1607462241578/kadusidipepezoxurek.pdfIn PDF document text
    • https://s3.amazonaws.com/zarevizebi/math_puzzles_brain_teasers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce7ad54b-9eaf-45fe-b3b7-ccc1c2a3e2d5/7511566284.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e1217a0-c3b5-4761-a0dc-9258257b4486/juruda.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016254.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16254 5260 bytes
SHA-256: 885f150694567ac2f82e7eaf7ef8e2a249925eaeff13258e1705af34e7d954bb
font_01_sfnt_off0001743d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1743D 12408 bytes
SHA-256: d8123997677b3a8b2d930047458b442aeb9a45ffe2e926cb20eb7b94420deb3c
font_02_sfnt_off00019e1e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19E1E 16068 bytes
SHA-256: 5bf3a568f44d28d5e01ddeb8052344ebf10f005948c245798f42be0336ee4cd8

Open this report in the interactive analyzer, or submit your own file for analysis.