Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d63ca753fe72c71…

MALICIOUS

PDF

82.2 KB Created: 2020-11-24 04:43:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02
MD5: b6d6b57656780a9d078f44dcd621cdbd SHA-1: 1f58bd884fde69b6524a42ac82ccb31d88fabc97 SHA-256: 1d63ca753fe72c71ff4a0a0a46a742d91d1f89ef5aa187057b1eb71a43958ade
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/strik?utm_term=po%25C3%25A8me+sur+la+fuite+du+temps PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4381108/normal_5fba46cfb844b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369330/normal_5f99a86df149e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379054/normal_5fa3eaf9e7900.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391649/normal_5f95fad21a522.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e1ed9fc-569d-4209-86e7-23778abc46cc/art_l_1221-1_code_du_travail.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c02ed8f9-25bf-40e2-ba96-df0813f4ee15/derefik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/26106629-e254-4b4e-84c2-a703bb12fe90/23772048299.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8376a9f2-707e-4977-aff8-2bf133e8a35f/96334070016.pdfIn PDF document text
    • https://s3.amazonaws.com/juvosi/autodwg_dwg_to_converter_2019_crack.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6ce5e6c-b18a-487e-9297-43946dca91f4/kodasefowalikebiraxata.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de64c795-ebc2-44ad-9873-9573fa04fc0c/mitchell_high_school_tennessee.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9234dbe-7a11-4a17-8c84-60137f351628/vudefatiteno.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/256ac2c2-7b2d-40b9-bfe1-50d5a20ba520/the_fifth_agreement_audiobook.pdfIn PDF document text
    • https://s3.amazonaws.com/kelukakeb/sheltered_instruction_pros_and_cons.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf50573a-8c4f-47c3-8c13-850b645c0881/73128656687.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fdcb8105-1860-4a66-90d2-6c50b704c444/74744535308.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e91b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE91B 5328 bytes
SHA-256: 74e5d42e3717909b73bd16b99fcae9eb60ba2c2d370cf05b9e3bf03f41fe4166
font_01_sfnt_off0000fade.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFADE 13388 bytes
SHA-256: f80eb8a06dc5ffd4a5a12a5bc7bba0e261ff22334112c729b6027091727b89f8
font_02_sfnt_off00012461.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12461 16076 bytes
SHA-256: 5d52f40a13f54bcc329d29992e3abd0fd28294c8bc547691d9075fb1d42365f7

Open this report in the interactive analyzer, or submit your own file for analysis.