Malicious PDF — malware analysis report

Static analysis result for SHA-256 17ef7e5c7c6266af…

MALICIOUS

PDF

193.2 KB Created: 2021-04-09 03:42:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: eb05ce07b1015e46582724d25e909cac SHA-1: 1a9d460179e82b9914adf6b1069551ff6f2a98d0 SHA-256: 17ef7e5c7c6266af52be0442e838ee6ceb21114734ada3f129a8699a1ca27aa2
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=final+fantasy+7+characters+ranked PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4454287/normal_5fdeeaced805c.pdfIn PDF document text
    • https://mafenipo.weebly.com/uploads/1/3/4/8/134879688/6200950.pdfIn PDF document text
    • https://viwuxujubefana.weebly.com/uploads/1/3/4/6/134625166/lomorokukekurig_polup.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454161/normal_5fe27350ca84d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486037/normal_605350674c745.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4418556/normal_5fff5cbd2abab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486775/normal_604efea2e56b7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467955/normal_601ad2d3878b8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4423699/normal_5fca93dfa0676.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4469128/normal_60085d82163ba.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4463543/normal_60000524cebb6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447252/normal_606da91569371.pdfIn PDF document text
    • https://lokamafurixese.weebly.com/uploads/1/3/4/5/134509290/vigimemo-malofima.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4443810/normal_5fded3f85df3c.pdfIn PDF document text
    • https://xafinuwexedigu.weebly.com/uploads/1/3/1/3/131379324/4952726.pdfIn PDF document text
    • https://lakerevuko.weebly.com/uploads/1/3/4/6/134654656/bd3653ed6313.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f78dbe36-82bc-4815-a4c6-3a7d9bf3baf2/kangaroo_math_competition_2020_registration.pdfIn PDF document text
    • http://jifujurudale.epizy.com/xefamefozux.pdfIn PDF document text
    • http://gugidopesuv.rf.gd/cahier_des_charges_d_un_site_web.pdfIn PDF document text
    • http://nonosolagosev.epizy.com/business_implementation_plan_template_excel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5ab9298-8577-427a-a60f-56df97631d61/71817424020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33bdc052-8685-4499-9317-d757719ce52a/central_vs_peripheral_vertigo_hints.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002098f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2098F 50348 bytes
SHA-256: e06facb62034c06031b951f0da07d437364fce3f3f82bec70ae124f4d2ef1565
font_01_sfnt_off0002a3b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A3B1 5308 bytes
SHA-256: 8b5b88125754eeea2a0d5dd41031c4d8a539a09a5865e0f4aa16e598ca30dfbe
font_02_sfnt_off0002b5ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B5CE 12876 bytes
SHA-256: a7a1726cfbdcebc5ad347fda6e05de762a746aca1adb220762e815ad1b7c7212
font_03_sfnt_off0002dfc5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2DFC5 16488 bytes
SHA-256: 021eaf6e245db5e9796d6b6553760bdf6420435298fcceecd052273e6f7cbf38

Open this report in the interactive analyzer, or submit your own file for analysis.