Malicious PDF — malware analysis report

Static analysis result for SHA-256 1514400a7e81f020…

MALICIOUS

PDF

88.5 KB Created: 2021-05-14 21:51:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 98abddebd961ac1c93024bfccf411e2a SHA-1: 5b06888589188a46edf88be03fd51cc395f872b0 SHA-256: 1514400a7e81f020b8a41befdee1e18809d5e6a758109df929f02b52a240bd04
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/strik?utm_term=the+police+ghost+in+the+machine+full+album+hq PDF link annotation
    • http://gufutaca6.xyz/salvation_army_uniforms_for_salev7nrh.pdfIn PDF document text
    • http://hugertely.xyz/foreo_luna_mini_2_guideemo2b.pdfIn PDF document text
    • https://cdn.sqhk.co/tuxisilogok/gPdibhe/17570906483.pdfIn PDF document text
    • https://cdn.sqhk.co/rowubuvuke/icYghZb/carpentry_tools_crossword_puzzle_clue.pdfIn PDF document text
    • http://prod-fruit.space/82206389696aopc8.pdfIn PDF document text
    • https://cdn.sqhk.co/kuwusemob/kijchgo/visolonos.pdfIn PDF document text
    • https://cdn.sqhk.co/zoluxoni/jhlFjek/nenutu.pdfIn PDF document text
    • http://arendagg.xyz/54621399691luaht.pdfIn PDF document text
    • https://cdn.sqhk.co/nokulebepoba/f7jiij7/44643432555.pdfIn PDF document text
    • https://cdn.sqhk.co/zixagiko/3Duibgd/96044027435.pdfIn PDF document text
    • https://cdn.sqhk.co/lisesemafo/gi1L2tv/74068565600.pdfIn PDF document text
    • https://cdn.sqhk.co/pavujakorige/2RyWRjd/logo_quiz_2020_answers_level_43.pdfIn PDF document text
    • http://onsideball.info/algebra_for_college_students_6th_edition_mark_dugopolskinku9o.pdfIn PDF document text
    • https://cdn.sqhk.co/berovanova/gf3ggUp/pixel_battle_royale_games.pdfIn PDF document text
    • https://cdn.sqhk.co/wenisuvuroju/fjjoMig/red_button_down_shirt_short_sleeve.pdfIn PDF document text
    • https://cdn.sqhk.co/regavebike/ajecngj/terop.pdfIn PDF document text
    • https://cdn.sqhk.co/gisusisabez/fjalH3P/yahoo_sports_mlb_scores_today.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/871a9082-67f1-4d4b-bed5-a3ca821a4aa9/20844954615.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/da0ca3de-e018-4b2e-85c5-7de6cd637578/wivitit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aff005a1-a0ff-4a52-ab88-ff7fcaf50419/pibulejola.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62c9e851-4313-4001-a067-03e3f7bfb76e/hp_6700_premium_printhead_replacement.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d27b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD27B 10008 bytes
SHA-256: eca5da4af667df78a314116bc2d76eed31804b738caa09f5028c95132de41307
font_01_sfnt_off0000f3ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3EC 5432 bytes
SHA-256: d50ff259126ee9ce5c424e87aa9f2f600d7d163c7cea5ebbdb15e07fa5f8e3b6
font_02_sfnt_off0001063f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1063F 12284 bytes
SHA-256: 69133f53d4b0e74cdf58ce5c2d9cbaba7e96027878d14fef9bec2761662b7430
font_03_sfnt_off00012df7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DF7 16204 bytes
SHA-256: 532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e
font_04_sfnt_off00014327.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14327 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.