Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b34a32172ef6f95…

MALICIOUS

PDF

77.2 KB Created: 2021-06-11 11:39:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 7b12e4866ff7b14490c39005035f5700 SHA-1: ccf2a83cbf35a9793f999d7cce2ee6e924db188c SHA-256: 1b34a32172ef6f95ef321b16cabf9365c9b932c850c5ae589e93b140a11454e9
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/pbw?utm_term=activate+windows+using+kms PDF link annotation
    • https://static.s123-cdn-static-d.com/uploads/4451210/normal_60b12c6bb288a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448535/normal_60476da69dda9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4402246/normal_60c154b4567a5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383146/normal_5fe517329bf94.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501995/normal_60bc2ac641b49.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421350/normal_60155bf28320f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421624/normal_5fcc6ced20eca.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376611/normal_605f34617fdce.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382639/normal_60b8bc89b292c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445564/normal_60468d6f6b314.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/81f56785-84d4-4928-abd3-a94612157406/graco_fastaction_travel_system_with_snugride_30_lx_reviews.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d0d7b583-4cba-45dc-b0fe-93569e37d33b/how_to_analysis_risk_management.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cafeb043-911f-4360-a41a-b5d24bde6a36/destiny_2_the_last_wish_raid_solo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ef29ac3-a3de-4065-8748-a6e2be708a59/what_is_the_meaning_of_mortal_engines.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/580f34f7-d376-4906-a266-2c26e9982b1d/mewifixazopotalo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02f6525a-fe2a-436b-9b7c-8d221c48f988/what_age_rating_is_pg_13.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1310b38f-4060-4ce4-b328-7d5568897645/hp_officejet_pro_8600_manual_wireless_setup.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/defd1fd6-f9cb-460c-80f1-aaeb77d1a1a1/1007022879.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fe093d9e-1bf4-479f-ba56-99c243a55a2f/73090012981.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b54a7782-eab4-4c1b-9329-310c4829dffb/nuwitutojalinujinege.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc66.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC66 5336 bytes
SHA-256: 2d2e020363afd376aa72de5efcb08d5f422d6534840c0ba8673354916c21f55b
font_01_sfnt_off0000ee9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE9F 10224 bytes
SHA-256: b8829473f30b6b6ca3c07f831d638be0c5ebec0e1358d6f59d3b318d95cd22fa
font_02_sfnt_off000111e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111E1 16344 bytes
SHA-256: ed45a24507f18daeaf6b6e9cac20235e9e43bed88bc2d44b7621eff085e31190

Open this report in the interactive analyzer, or submit your own file for analysis.