Malicious PDF — malware analysis report

Static analysis result for SHA-256 14e38aae66fb69b3…

MALICIOUS

PDF

112.4 KB Created: 2021-06-03 02:33:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 2c29b64e9ef2ea53f56b490eb90fc899 SHA-1: 119a34fb80ccbc69d72c425bb33b67d3c48fbbc4 SHA-256: 14e38aae66fb69b3c6b99eb4783a2704bdf201dbfbc92bb747e7adf7159d4ac2
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pixomot.ru/pbw?utm_term=who+is+doctor+joe+dispenza PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4472491/normal_603384930998a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489975/normal_60640ee22f4d0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420432/normal_601f34269ca1b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381541/normal_5fe726a61cd0b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375076/normal_6066f4611c390.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426945/normal_6011a09f857d4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445104/normal_6003db893f564.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485810/normal_6064acff1ceff.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d493306-98d1-4e4f-bf95-8ec0b56eb081/88640850195.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95a2c314-861b-4aa9-ae5f-00b9b809722e/4085077457.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30246f56-0fcd-4b53-bdf5-3377e6b08f72/83420291505.pdfIn PDF document text
    • http://kelivesas.pbworks.com/f/fusowujekejaxev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9731fa0-e517-4b10-a9b2-d490e794f458/88577806692.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38e6beaf-61bd-49a7-a77e-2fdae0d45dee/vadufoxoj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5e13836-59b4-45bd-b735-cb1fe7e6ea5f/shark_professional_steam_mop_replacement_handle.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/93371eb0-db12-410b-bac9-abcf3a3db857/star_vs._the_forces_of_evil_star_and_marcos_guide_to_mastering_every_dimension_guide_to_life.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a2bff9b-2c8b-4762-9010-29599a5bfe59/31760550884.pdfIn PDF document text
    • http://mikabipi.pbworks.com/f/missouri_boater_safety_test_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70fe63f1-ffb8-4023-b950-1c8f14893cba/resumen_del_libro_el_libro_de_los_abrazos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6b28398-08e5-4fba-ab0e-c8064ae9a9e5/70122097940.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017bbf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17BBF 5268 bytes
SHA-256: 401c282deeb1b8f8ed7a41eab75c69f1438b68e39e47f63cf098caa8981f1765
font_01_sfnt_off00018dbc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18DBC 11348 bytes
SHA-256: dda911fd54aaa7f93b266fd16612a5293d0b22b3971f2c782bccfe8f4f68abe9

Open this report in the interactive analyzer, or submit your own file for analysis.