Malicious PDF — malware analysis report

Static analysis result for SHA-256 184cc1f8d378071a…

MALICIOUS

PDF

82.3 KB Created: 2021-03-18 13:33:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 9a329fc96f29cf76c14ae6de7594c5d3 SHA-1: 3d1d975070ca46f2e5d250250a1e2b456b5c1229 SHA-256: 184cc1f8d378071abccb10313dd5b41ace176de024b49fd338e13c56d5cb898a
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/wix?keyword=making+america+6th+edition+pdf PDF link annotation
    • http://tazizinujumijoj.mywebcommunity.org/91557674398.pdfIn PDF document text
    • http://jibakerutev.mypressonline.com/55390326275.pdfIn PDF document text
    • http://pogadai.xyz/nagazitotinimesozonilav083e5.pdfIn PDF document text
    • http://votixibutiro.medianewsonline.com/divinity_original_sin_2_rune_crafting_guide.pdfIn PDF document text
    • http://desajegurake.scienceontheweb.net/37369364091.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368742/normal_5fd31b6205304.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487424/normal_604cfd6ca6a32.pdfIn PDF document text
    • http://pink-echo.club/37295860980sfjip.pdfIn PDF document text
    • http://kengoru.space/algebra_equations_worksheets_year_9kvzmq.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444377/normal_601c8faf13d87.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/jotogorurekuro/xidofefenojitudotegepe.pdfIn PDF document text
    • https://s3.amazonaws.com/fazujo/verbal_reasoning_test_11.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea1abc0a-0f5a-4e8f-8c2a-d3100131a7fb/when_was_the_apocrypha_taken_out_of_the_king_james_bible.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea26a9d2-5af1-4efc-ad32-97bc8fff1860/firemenojijimivafuzin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/727c3995-e4d8-4910-b007-362247cdafbe/kidipubofelarukuf.pdfIn PDF document text
    • https://s3.amazonaws.com/panokojol/75463548834.pdfIn PDF document text
    • https://s3.amazonaws.com/lizuseguwix/ap_environmental_science_frq_2011_scoring_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/petuzutemixuvod/avalonia_vs_wpf_performance.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6d7f1861-74a7-4204-834e-12a52cb5f2ec/how_to_take_apart_a_cpap_machine.pdfIn PDF document text
    • https://s3.amazonaws.com/pewibim/sejesunidetebonoporati.pdfIn PDF document text
    • https://s3.amazonaws.com/vufuzewasi/how_much_wealth_does_the_top_1_percent_have_uk.pdfIn PDF document text
    • https://s3.amazonaws.com/lezopobigeza/gegenulusalolizurawos.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f817.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF817 5368 bytes
SHA-256: 534e8494f77dc266f3d9ae3a49fdf4db3746d9d0157cddd8dd7e6e8b86c91d9e
font_01_sfnt_off00010a29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A29 10352 bytes
SHA-256: 0f25902cb45f6146b487d294551605fc664ed82928b248da0fa709fb4b75d30d
font_02_sfnt_off00012da2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DA2 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.