Malicious PDF — malware analysis report

Static analysis result for SHA-256 2179856fff5ebfee…

MALICIOUS

PDF

80.2 KB Created: 2021-05-23 15:01:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: b53fe46c0b092e3338694a4c35af3330 SHA-1: 17ec2251f0e09fd4545fad17a916f14f4c02f6dc SHA-256: 2179856fff5ebfee25ca36a052742d5a11c2e11c6a3f7fb9c470b85a7a7a5638
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=process+validation+protocol+example+template PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/2b082166-09d9-4168-a571-078c831e9134/luburilugiz.pdfIn PDF document text
    • https://s3.amazonaws.com/ronenitevodo/xerox_7855i_printer_driver.pdfIn PDF document text
    • https://s3.amazonaws.com/gimufesajo/rotases.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/faa7a539-53f2-470d-9a5b-4343c0cc9fa3/what_is_the_best_bleaching_cream_for_face.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa7a23c8-0a2e-4c92-bc7f-077d268f9fdd/87620195755.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f29bdd27-1879-47b5-ae2d-9eff25f520dd/wibevobe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5219ac18-7643-4156-bd98-58543c8c6c8e/jbl_flip_3_bluetooth_speaker_wont_connect.pdfIn PDF document text
    • https://s3.amazonaws.com/rorives/50597440810.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b0d4cd6-b31a-452b-aeb8-e2b8a74d6acd/how_to_lookup_a_citation_number_in_north_carolina.pdfIn PDF document text
    • https://s3.amazonaws.com/zowibatev/the_crush_imdb_parents_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/74200e4e-0b62-4465-b1cb-f16a71789923/30723028425.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb2ac1e2-6389-4495-ac66-bb60037564a5/tiger_rice_cooker_repair_canada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc9b4f33-533f-4b3d-ae03-be723475bf48/dupokuwisebame.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9cfddbb-525b-4670-892f-05f728b22e36/mvc_tutorial_microsoft.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9f3ba02-c8b5-448b-9074-78870fe21d96/12565545924.pdfIn PDF document text
    • https://s3.amazonaws.com/vavejijitatofu/how_to_look_up_osha_fines.pdfIn PDF document text
    • https://s3.amazonaws.com/xoxaneral/briggs_and_stratton_vanguard_16_hp_parts_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/toniseligiwuzux/amazing_grace_sheet_music_trumpet_free.pdfIn PDF document text
    • https://s3.amazonaws.com/wotodedaruzuk/what_is_student_engagement_and_why_is_it_important.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66b279ce-e26b-449c-b455-0dd2a4251c9d/43587422718.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE1B 5136 bytes
SHA-256: ac805175fa6386d99f8203ba968d81866df992de0e675794f7255575f81df58c
font_01_sfnt_off0000ff70.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF70 11136 bytes
SHA-256: 8a79348184131f68a9726d5c65227d82da19ab8aa43329184776c6076cd274c1
font_02_sfnt_off00012551.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12551 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.