Malicious PDF — malware analysis report

Static analysis result for SHA-256 107585fc5d81124d…

MALICIOUS

PDF

67.6 KB Created: 2021-01-08 13:34:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 45b4edf4a0b6a7d1bc92ca8093490bd2 SHA-1: 46a046d9dbf8da3d0d6f1bfa9ef82a3c68363e31 SHA-256: 107585fc5d81124d24adcab0736dc82abf94e990db6f34c8b797b76b0b31d3f9
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=algebra+1+regents+august+2019+answers+jmap PDF link annotation
    • https://cdn.sqhk.co/bipukawu/fxgjhgs/simplenote_markdown_preview.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4373271/normal_5ff0334a5bd55.pdfIn PDF document text
    • https://cdn.sqhk.co/rukeditele/3zX6JzS/watobiwusesojusegipaxa.pdfIn PDF document text
    • https://cdn.sqhk.co/sepovili/bgfhg3J/tipatomi.pdfIn PDF document text
    • https://cdn.sqhk.co/wexazaruko/1VMjyva/xelopapuxamodaw.pdfIn PDF document text
    • https://cdn.sqhk.co/gusoguribus/7iahdjf/classic_chess_sets_wooden.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382643/normal_5f9526f8bc2a9.pdfIn PDF document text
    • https://cdn.sqhk.co/zoturisa/gchbvlB/christmas_events_this_weekend_in_ct.pdfIn PDF document text
    • https://cdn.sqhk.co/masamiwe/TFE9eNs/wepuvapez.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5fa86d7a-6eed-4112-a6f9-c4a6ba266525/striped_pangasius_fish_fillet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/534101a0-217d-4b3d-a497-bfbbedaf809e/87783776704.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c7ca5374-f0ce-4299-bed1-cea9510f2689/33098576991.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff29b49c-494c-4b3f-9a7d-53f62b20102f/durora.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6cad582e-7dfa-45dd-9b79-c5f238a3f701/80618540771.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0bbce0e6-de5a-407f-9ae8-4294c8573618/31104614131.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7548fcb0-7f9a-4812-80d5-a7ab53b0b368/31629764382.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ca66.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCA66 5920 bytes
SHA-256: 379190b9266b8e426c59167914994b74606cda4bd2fe67a1854595f28d7ba740
font_01_sfnt_off0000de88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE88 10168 bytes
SHA-256: d5c74acdd563c97031867820e2525ea25dfc721a3df05a53af6ceae104a21562

Open this report in the interactive analyzer, or submit your own file for analysis.