Malicious PDF — malware analysis report

Static analysis result for SHA-256 217ebe183e2bd83b…

MALICIOUS

PDF

69.3 KB Created: 2020-12-17 00:33:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02
MD5: 5be1dc4d6c2de2595844a142fe99d8cf SHA-1: 946e6b40b2adb3a015806a928bf704b516ea1e76 SHA-256: 217ebe183e2bd83b2154757443db77330f59b29a836d43ae404d54270262c67f
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/123?utm_term=knights+and+dragons+mod+apk PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4393916/normal_5fb2c0b935769.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464070/normal_5fd64317c4a05.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450870/normal_5fbf59a7024c6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pivetuzadujo/xasexisawesikedobokod.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe3642fa04221c71eba12d/1606301251824/pagazobevapemumemutude.pdfIn PDF document text
    • https://s3.amazonaws.com/nigimul/cavidades_corporales_del_cuerpo_humano.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd1dca7849622016c3a880/1606229450551/30371609612.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48f86cc3-1e1c-4c3f-8345-978952b4cedb/tulepowonoxujutib.pdfIn PDF document text
    • https://s3.amazonaws.com/wibedubosateg/53345446629.pdfIn PDF document text
    • https://s3.amazonaws.com/tesapibebujep/92868079092.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2783ae09-d612-4a2b-8d87-a8c4ec2c500c/ihya_ulumuddin_quotes.pdfIn PDF document text
    • https://s3.amazonaws.com/jubiferekaka/21136346036.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62ec8649-5b6f-496e-b89e-9e09db578825/wiseguy_tv_show_theme_song.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2146843-ad5c-4bc7-9394-02a68ac72d3a/95520479231.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e575bdd1-a33c-44f3-a865-66f5c34155ff/sanatatenazimaxe.pdfIn PDF document text
    • https://s3.amazonaws.com/xalasawu/the_legend_of_korra_season_2_episode_1.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD2EC 5372 bytes
SHA-256: 287dc1cae8a8896277b90c4cea9b1f427cb0cfd93462880fd72613096286b10c
font_01_sfnt_off0000e508.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE508 10384 bytes
SHA-256: 988385550bbacddd2bcbb1f5e5766e985778603227f750428b8f9dda0b73c0a3

Open this report in the interactive analyzer, or submit your own file for analysis.