Malicious PDF — malware analysis report

Static analysis result for SHA-256 13bfc0d375490583…

MALICIOUS

PDF

493.0 KB Created: 2021-05-30 00:53:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 32abd80a19146e6a31a88117f01387f8 SHA-1: 72d97d14a6e04ebed4ae00673b5a0f42d817d168 SHA-256: 13bfc0d375490583acaf7a2a5b5f2deb17e3e4f792f4be4eaa39c5cfb75f85f5
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9118

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/123?utm_term=anemia+falciforme+terapia+nutricional PDF link annotation
    • https://diveziriluro.weebly.com/uploads/1/3/4/4/134447321/zoxojulolukuxazuli.pdfIn PDF document text
    • https://saxipapes.weebly.com/uploads/1/3/0/7/130738636/334448.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382208/normal_605d7030eee97.pdfIn PDF document text
    • https://viriparerari.weebly.com/uploads/1/3/5/9/135978168/fusasobogegekoj_sebabelat.pdfIn PDF document text
    • https://zexivavu.weebly.com/uploads/1/3/4/8/134872555/komebexupuzevi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379731/normal_6029d261b0a24.pdfIn PDF document text
    • https://torovuzexas.weebly.com/uploads/1/3/2/7/132710592/859974.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4491687/normal_5fec230fd8d83.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454995/normal_606e82625175f.pdfIn PDF document text
    • https://kenomixu.weebly.com/uploads/1/3/0/9/130969587/8671874.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446781/normal_5fccb20a9ed12.pdfIn PDF document text
    • https://pewenotevis.weebly.com/uploads/1/3/4/5/134597539/316e278a5f1cc8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387408/normal_5fd6229585394.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468554/normal_5fd67f68ecdaf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485710/normal_6048f07bc491f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ef605dd8-fff1-4e58-902d-44f68d2537c0/96026871114.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fdf8d29f-170f-4e09-b1d4-1bc208a30ed2/troy_bilt_riding_mower.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ac3a616-6a64-4a08-836b-b8393727e176/tipos_de_investigacin_educativa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ebddb5a-934d-4b7a-a873-38b89818a881/how_much_is_a_2009_bmw_328i_worth.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d31b8a27-d700-4767-b368-965728c79e6d/john_deere_l120_steering_repair_kit.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000764d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x764D9 4972 bytes
SHA-256: 18a49aaae5663be80c86a4f7e7a803263f660dc589423f56a4d88d924a922089
font_01_sfnt_off000775af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x775AF 14468 bytes
SHA-256: 98ccf350a561e10ff1ee6b3b5c7a8a489d363799e64ec0c1a3cbe9a2fc92f53f

Open this report in the interactive analyzer, or submit your own file for analysis.