Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ffb588aabaf7c1f…

MALICIOUS

PDF

75.4 KB Created: 2021-04-07 01:24:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 846babba5dd353ee4c970279450fe45b SHA-1: 573b819acddb5ce0c1558066c976161923d283c7 SHA-256: 0ffb588aabaf7c1f2d8751dbfadaef4b716cef45a3bbd5e5a73247a7f6589ff6
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/wb?keyword=fisher%20&%20paykel%20dishwasher%20error%20code%20e20 PDF link annotation
    • http://winoraama.fun/foxasozofolonegyao6o.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452376/normal_606023f7790a8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372378/normal_604125a77ffc3.pdfIn PDF document text
    • http://stassikorskyi.com/namosebopalebep9toxv.pdfIn PDF document text
    • http://nout-sale.site/22944574815x7us4.pdfIn PDF document text
    • https://cdn.sqhk.co/jilowepe/Ria2iev/gold_rush_gold_season_game.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486033/normal_601d1e8fed032.pdfIn PDF document text
    • http://gufutaca5.xyz/48492420672btxin.pdfIn PDF document text
    • http://ro-shop.space/185793748931nw08.pdfIn PDF document text
    • https://cdn.sqhk.co/fojilude/jhGqwXJ/google_login_button_guidelines.pdfIn PDF document text
    • https://cdn.sqhk.co/fularulojoze/jcgf6N3/45393737387.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/libosokune/android_api_level_18_name.pdfIn PDF document text
    • https://s3.amazonaws.com/nunakixuma/42730082685.pdfIn PDF document text
    • https://s3.amazonaws.com/risisipajole/mefizowalirofuvasi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b50314fe-2f1f-4100-acef-47d33695b24b/yamaha_01v96i_usb_midi_driver.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/988f02aa-5581-4fde-b250-9494b21534be/5455171025.pdfIn PDF document text
    • https://s3.amazonaws.com/ragejufa/xidetete.pdfIn PDF document text
    • https://s3.amazonaws.com/tiduro/80414567598.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/07104953-1270-4263-8458-13d3c09751ae/wunome.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11807416-2ab0-4a05-8aa0-c139fb5cbb5e/social_psychology_books_for_beginners.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/716e52e0-a124-404e-8497-9178ec08e305/64659758478.pdfIn PDF document text
    • https://s3.amazonaws.com/tokit/why_is_civic_important.pdfIn PDF document text
    • https://s3.amazonaws.com/vebisop/how_to_fix_emergency_brake_on_john_deere_gator.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eaf2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAF2 4480 bytes
SHA-256: 77ebb72579ab4d5b9c7d295fc4bb60f6f4a378c1805215f458dd727eab32eccd
font_01_sfnt_off0000fa1d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA1D 11220 bytes
SHA-256: b3836e99f9d335189d47d1f13c5570e3bf4468f8f1a5a059bc0b0ddcbcab0926

Open this report in the interactive analyzer, or submit your own file for analysis.