Malicious PDF — malware analysis report

Static analysis result for SHA-256 1da03ff243476016…

MALICIOUS

PDF

77.7 KB Created: 2021-03-12 11:40:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 773cdbb9cf5b5769639278bee11a1d01 SHA-1: 9bf4796dd243f2a6c4333224100d02840ee25c0d SHA-256: 1da03ff243476016215d21922364beb8dea2a002bb0113bc99ae4a93fd43c043
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=rectifier+circuit+pdf PDF link annotation
    • https://cdn.sqhk.co/vilomikov/gehghbo/year_of_the_rabbit_2020_predictions.pdfIn PDF document text
    • http://levantegroup.net/2012_chevy_impala_ls_manual00cwn.pdfIn PDF document text
    • http://tixshopclub.fun/juduf4ho0x.pdfIn PDF document text
    • https://cdn.sqhk.co/gilubibawi/sKieji8/xodoxadizuzitafimodilago.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/71b1f586-61ea-4013-96a1-98fbec5acd40/hp_designjet_500_42_driver_windows_7.pdfIn PDF document text
    • https://s3.amazonaws.com/zuwimadaneb/puzzledom_mod_apk_unlimited_money.pdfIn PDF document text
    • https://s3.amazonaws.com/zowibatev/42766806769.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/46a281d1-fa8b-4a57-9ba9-598b4ed88919/81365958179.pdfIn PDF document text
    • https://s3.amazonaws.com/xisefowu/25819724702.pdfIn PDF document text
    • https://s3.amazonaws.com/defujo/bdo_wizard_gear_guide_ps4.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a15cd40-5013-4e81-904c-d3110e56e52e/91567507562.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e528d498-de94-4e05-afce-b7f5f0c23f0a/barrons_800_essential_words_for_gre_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/fuwenoxuzasila/final_fantasy_tactics_a2_mission_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/timituvupame/bharatanatyam_is_the_classical_dance_form_of.pdfIn PDF document text
    • https://s3.amazonaws.com/wunojipu/kiruwikerili.pdfIn PDF document text
    • https://s3.amazonaws.com/kegubinefuda/jexas.pdfIn PDF document text
    • https://s3.amazonaws.com/ladiwuzetawedi/clarinet_sheet_music_for_silent_night.pdfIn PDF document text
    • https://s3.amazonaws.com/kikunojulejuj/automatic_thoughts_worksheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f63d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF63D 4736 bytes
SHA-256: 9237284618116e7ee2e3d0213922db39f9a88e93d3034009fa4e6a839920248f
font_01_sfnt_off00010675.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10675 10392 bytes
SHA-256: 22f05af47c75e025998235fdcc76318405f865c01b904a78815bd6cc7f246e13

Open this report in the interactive analyzer, or submit your own file for analysis.