Malicious PDF — malware analysis report

Static analysis result for SHA-256 1683c7ca7751c3dc…

MALICIOUS

PDF

75.6 KB Created: 2020-12-17 20:11:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: f858d74434f973eea2d771f13fb8ee81 SHA-1: 8493b91e726d70beef8f0775f2484817f7b5e3ad SHA-256: 1683c7ca7751c3dc9a743e7470d4504b531e1844d71a62a6842e0b1a9f0781ac
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6053

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?utm_term=crystal+report+13.+0+2 PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://static1.squarespace.com/static/5fc0e9eb3398ff75152e2002/t/5fcaff40da45e86cca9b6271/1607139136227/wunetawedowedelanajuj.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc57d743dfdd95b60f42251/t/5fd70138b1c3f31c7a984423/1607926073078/mewawigidibewosiluxaguvi.pdfIn PDF document text
    • https://s3.amazonaws.com/dinisemowoge/list_of_important_days_in.pdfIn PDF document text
    • https://s3.amazonaws.com/tetazino/19639795441.pdfIn PDF document text
    • https://s3.amazonaws.com/levumoduf/lab_table_minecraft.pdfIn PDF document text
    • https://s3.amazonaws.com/ritoma/noodle_st_menu.pdfIn PDF document text
    • https://s3.amazonaws.com/libowebujakux/illustrator_template_scientific_poster.pdfIn PDF document text
    • https://s3.amazonaws.com/limewub/gipiregejezudozorukegu.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc3703b8ef7301f8b20f9e5/t/5fc816f013f8d93bf2f6534c/1606948593639/learn_drawing_online_step_by_step.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1619768612547ed61873d/t/5fc7fd9a3c4d2a09b19be198/1606942110348/74330572385.pdfIn PDF document text
    • https://s3.amazonaws.com/felasorarabipis/busavorog.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc158a49698b02c7f23b694/t/5fc5ba2918e72e5fdb9dd9eb/1606793775102/standard_handbook_for_civil_engineers_4th_edition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a396daa8-59c5-419f-a9c3-19afb5fccf8c/discernimiento_que_es.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c2b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC2B1 2948 bytes
SHA-256: 6193ae5e1ba9309bf1242d6e0a406601078bce13db99ffdf9b0cff6bbb146ce8
font_01_sfnt_off0000cd36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCD36 5344 bytes
SHA-256: 8a0330b90b9e19eff123813573780de15c0afa8cafdafe4026ff6a191f5ac8d1
font_02_sfnt_off0000df72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF72 7508 bytes
SHA-256: 9d52bbe4912e80c09c63333ac02d011a8d48b1abae0a499f6dedc7201df134c1
font_03_sfnt_off0000f396.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF396 10868 bytes
SHA-256: 1736fb439997856f36fde13ea5ac03e4adcb9897ea432c3068fc3269969e724b
font_04_sfnt_off00011843.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11843 16224 bytes
SHA-256: 1c17671fdb71884e9f81320ad22bd52d44677ebfe0e89e1da73fe2eadff84207

Open this report in the interactive analyzer, or submit your own file for analysis.