Malicious PDF — malware analysis report

Static analysis result for SHA-256 12bb068db1885f05…

MALICIOUS

PDF

80.1 KB Created: 2021-04-06 03:57:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: e372962e007727498c501b1372c528ba SHA-1: 71e013ddac7d681bc406cb6cfbe7d42eb99d3842 SHA-256: 12bb068db1885f055ff740dee5cd68aff42476bd49acdef67737b5c70ee9e4dc
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=robert+kiyosaki+fake+book+pdf+free+download PDF link annotation
    • https://cdn.sqhk.co/nivunufozub/chciaoe/lufepagokebix.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372377/normal_5ff59f55a28f1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408601/normal_6047ee2b0b5dd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408184/normal_6024cf979d403.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454684/normal_6044dc7656c20.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421365/normal_5ff68bf40e94c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421350/normal_601acced40a64.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419828/normal_60393612ad284.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4466143/normal_6017dcc000eea.pdfIn PDF document text
    • https://cdn.sqhk.co/xonipavu/5ibgiku/3226763827.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365553/normal_602c0ad34002a.pdfIn PDF document text
    • https://cdn.sqhk.co/girasufu/dH4jgiE/bufojureme.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496824/normal_605f697349de4.pdfIn PDF document text
    • https://cdn.sqhk.co/ritasuxa/hxiKNC7/zupixojakadazuvujiju.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/91d7fc9f-d5db-41e4-99e5-52b6495fecec/what_are_inferential_statistics_questions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4795d40b-6e5b-4d55-bdd0-df19e1f0c55b/xojeve.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/edd73573-d4fd-4067-8c56-7043b2450bed/graphing_inequalities_practice_sheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7662e494-e955-4bdc-9814-39edf4eea460/kolareguxifunejek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5308d0cc-9777-48d2-aef9-d4eedd50993e/fujitsu_fi-6130_maintenance_kit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7b82bbeb-ec23-481e-98cd-050278509961/starting_strength_program_for_seniors.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2caaffe6-e060-4652-93ce-9f276b7082e5/43059438286.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/298b11a3-8bfa-4d59-8a7e-1958336f73e1/explicar_el_concepto_de_tabla_peridica_de_los_elementos.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f5b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5B4 5440 bytes
SHA-256: 1f31432d7e2aab2da2f8b1a5e2b946e24a555959520dc9184b06b883868b5181
font_01_sfnt_off00010863.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10863 12888 bytes
SHA-256: e154503870a873883727cd78484f5cee4778e4f1b36a1cceaeabbd2ec7e869b4

Open this report in the interactive analyzer, or submit your own file for analysis.