Malicious PDF — malware analysis report

Static analysis result for SHA-256 11cec76c7663e9e0…

MALICIOUS

PDF

81.6 KB Created: 2021-04-17 06:10:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: b87933a158ddccb40fdd2586c2613d07 SHA-1: 9c6115d3634987a7bd4d85cf0bf5d1142394be71 SHA-256: 11cec76c7663e9e0b1b7d5dbd610c8d28cefca72573d4b4b29d2862012392602
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/strik?utm_term=how+to+write+one+and+three+hundredths+as+a+decimal PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4463272/normal_60001f8443e5d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393647/normal_60219ca7324ca.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416140/normal_6035667c68078.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366633/normal_606ce6e866ac8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458412/normal_5fdc215c6bc33.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/petikamov/what_are_the_most_popular_fairy_tales.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2669961f-87b3-4bee-9b05-75e64d47d768/rikusiveko.pdfIn PDF document text
    • https://s3.amazonaws.com/setaxilitozuko/16508173884.pdfIn PDF document text
    • https://s3.amazonaws.com/serogajugomiji/gulekem.pdfIn PDF document text
    • https://s3.amazonaws.com/fotojipifuzitul/father_figures_parents_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/kulinisokakewi/baby_einstein_neighborhood_symphony_activity_jumper_assembly.pdfIn PDF document text
    • https://s3.amazonaws.com/pisedij/78140158129.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b17d0d33-06cb-44ca-8e3f-7f010b944d1d/rubexobevumadu.pdfIn PDF document text
    • https://s3.amazonaws.com/dutimajizowa/adblock_firefox_plugin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f6522cc5-1f1d-4623-823e-b525e0f830bf/what_are_the_importance_of_using_electrical_safety_devices_at_home.pdfIn PDF document text
    • https://s3.amazonaws.com/rokuwapesu/netflix_apk_for_android_5._1._1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fe812f9d-d722-413b-b32c-e55f3daaf2fd/walmart_grocery_phone_number.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bdbec4b6-d500-461d-9f8d-66fa0b781a25/32365693392.pdfIn PDF document text
    • https://s3.amazonaws.com/dubiditiginowo/dieta_cetogenica_50_dias_gratis.pdfIn PDF document text
    • https://s3.amazonaws.com/kabisebax/darkest_dungeon_2_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/legipalofi/77112582220.pdfIn PDF document text
    • https://s3.amazonaws.com/vuterijoze/33117692015.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010205.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10205 5232 bytes
SHA-256: df90a092d2f7c03edb32df05ee9fa8b0033bfcf27ad5633fa4731c709042d812
font_01_sfnt_off000113b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x113B1 10756 bytes
SHA-256: 35d46b761542e0832eab3ba5694b925ef55719a7af1eb28070c792bc9f173de6

Open this report in the interactive analyzer, or submit your own file for analysis.