Malicious PDF — malware analysis report

Static analysis result for SHA-256 21c0f7e60bed987b…

MALICIOUS

PDF

80.7 KB Created: 2021-03-16 01:49:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: f672cda938905afc4ce6466ad8192337 SHA-1: 90ae1b997befd078d1631526021e8046b164e004 SHA-256: 21c0f7e60bed987b3237a29c58cf7d6b00d599d149a363cca7e0802595780cc8
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=how+to+find+the+horizontal+component+of+force PDF link annotation
    • https://cdn.sqhk.co/gutemokerezo/iKIiiie/71721884407.pdfIn PDF document text
    • https://cdn.sqhk.co/voguzasijur/jjgfnib/mixikepur.pdfIn PDF document text
    • https://cdn.sqhk.co/zobelekivix/egdjbWP/bendy_and_the_ink_machine_coloring_pages_boris.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3932e67-cfc9-435a-babd-e2cecccaeb53/night_out_outfits_ideas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f14309c8-cd3c-4940-897f-a305759ab2c8/pixakiwudokojipukodelanun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a82d446c-01e4-48cd-8ce0-d929eca49e3c/brandon_sanderson_stormlight_archive_box_set.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d21f728d-b546-4e59-b79a-3e06afbd0006/wolf_toaster_oven_costco.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/08e03f2d-2e18-42ff-8e3a-cdab0205ecb2/21711314414.pdfIn PDF document text
    • http://gomojilen.rf.gd/59884439529.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d31094a5-6ecd-41a9-b484-8ab10a43fc3e/41639932360.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/deed19e9-c245-43df-b035-d8929da596a4/sexesatem.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/07722ccc-4f86-4510-a479-e7d5d2e6e4fb/31799924679.pdfIn PDF document text
    • https://s3.amazonaws.com/nopomewegobij/reportage_sur_les_garde_du_corps.pdfIn PDF document text
    • https://s3.amazonaws.com/resixexi/rufadukobonalojiferazi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad9928b1-d2a9-4609-acdf-94de74f8c21d/giferojifikusofafuta.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f486e5da-dbe5-430b-ba2c-e5e77b8ed99c/gepofafimolomedutanebo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/058b5d32-0259-4c09-b597-79b8e3aeb878/62153713610.pdfIn PDF document text
    • http://watijosanowo.epizy.com/45799887286.pdfIn PDF document text
    • http://paduwovipubu.epizy.com/32507344115.pdfIn PDF document text
    • http://fejozimi.epizy.com/29198607886.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9a97050-8198-443f-aa15-0b07d082f91b/ritupudaxap.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fcf2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCF2 5320 bytes
SHA-256: 2ca43529ef58c73d8e00f9b1c5472e9e104e11b6eb875983212cfa178c912358
font_01_sfnt_off00010efb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EFB 11132 bytes
SHA-256: 6b1aa810d2b7e84d9ec2f10d393dcb4abf2629fbb08a334b8bdfa9117243c31e

Open this report in the interactive analyzer, or submit your own file for analysis.