Malicious PDF — malware analysis report

Static analysis result for SHA-256 20d170a06b7cc6ec…

MALICIOUS

PDF

86.4 KB Created: 2021-03-25 17:11:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 9e2bde620527e3c82d1b4b955a231064 SHA-1: 12840a0ba96ae68f83c19edbdca435251bcebf7f SHA-256: 20d170a06b7cc6ecae65940552fa4faca5861bb373dffb598a0f2d39533ff0e1
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=a+mini+baganiya+song PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4380073/normal_5feb41f1a1f0b.pdfIn PDF document text
    • http://podarokinsta.site/585589719091cf3w.pdfIn PDF document text
    • http://malanefire.sportsontheweb.net/approach_to_obstructive_jaundice.pdfIn PDF document text
    • http://sigisuzuk.getenjoyment.net/17160053015.pdfIn PDF document text
    • http://rakivabe.sportsontheweb.net/characteristics_of_life_lab.pdfIn PDF document text
    • http://faxusupovetek.sportsontheweb.net/25528228396.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469641/normal_6016a5d652dd5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449973/normal_5fd6484db6181.pdfIn PDF document text
    • http://hellesypakk.online/is_the_kings_speech_movie_based_on_a_true_story0dkcb.pdfIn PDF document text
    • http://fudoviwil.mywebcommunity.org/vukituj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464732/normal_5fe6e2419154b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459792/normal_5fd968f91c727.pdfIn PDF document text
    • http://snapchat-alert.com/head_first_pmpyy7q7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pazerogasarinu/clinical_guidelines_in_family_practice_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/jukoxisojow/regurafeti.pdfIn PDF document text
    • https://s3.amazonaws.com/firigugixujotov/vanity_fair_subscription_address_change.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dee79cbd-bc2a-418d-98c6-09ebd11fda70/zogesededanetopife.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3088802e-c88b-43b4-ad2b-774ecc6ecaff/diccionario_juridico_espaol_ingles.pdfIn PDF document text
    • https://s3.amazonaws.com/zidenigad/trials_of_apollo_series_characters.pdfIn PDF document text
    • https://s3.amazonaws.com/mojivikapeti/82979458053.pdfIn PDF document text
    • https://s3.amazonaws.com/tofizo/flash_man_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/patotale/lulozasevidefoxaruxajoga.pdfIn PDF document text
    • https://s3.amazonaws.com/widofafane/norenoxuvon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/415755e3-1541-45cd-ac08-35817edb8386/94922798785.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD8D 5108 bytes
SHA-256: 0b832e84998a386d60b9cbbe59517c7e5e50353db770c5db15956e414edfdab3
font_01_sfnt_off00010eeb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EEB 11140 bytes
SHA-256: c1733bccd1c6ad358c0f11eac5d3b6ca12e60a2eb6fa501561eb08beac7c6e56
font_02_sfnt_off000134cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134CF 16312 bytes
SHA-256: aad9bc0f36eadc3314e08670b59090120051e308b357201f134af3d0b781b2b0

Open this report in the interactive analyzer, or submit your own file for analysis.