Malicious PDF — malware analysis report

Static analysis result for SHA-256 22c626bf2b963f92…

MALICIOUS

PDF

70.0 KB Created: 2021-04-08 05:44:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 43a15e73bbc3af2531c553f02a118c60 SHA-1: 1610010ba03a0503ad6cb2d31858ae8045fe32c8 SHA-256: 22c626bf2b963f92289d0fe71da4e0aaa9c23d7bba4255ab46ff3de0530dff7d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=para+empezar+realidades+2+answers PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4380392/normal_60418def8062d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374968/normal_5fcd42312ff77.pdfIn PDF document text
    • https://cdn.sqhk.co/pobisobat/igghgja/magic_rush_heroes_apk_uptodown.pdfIn PDF document text
    • https://cdn.sqhk.co/kuwusemob/CeW8Yie/rimidozilitimonofitiga.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478685/normal_606846673d5a5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390383/normal_601454e894ab1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jebupofedijakuk/north_carolina_dmv_written_test_cheat_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/mefadedosuw/what_is_the_theme_of_looking_for_alaska.pdfIn PDF document text
    • https://s3.amazonaws.com/rimepusox/getboundingclientrect_vs_offsetwidth_performance.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c7b7628-eb54-4e6c-a0ee-911685916f5f/how_to_read_winds_aloft_report.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ee4b1ccc-2d02-4964-8b36-df7af8a7abbf/the_quran_in_english_and_arabic.pdfIn PDF document text
    • https://s3.amazonaws.com/tobovunoberiki/lofoten_islands_travel_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e3a5b12-2019-4aa5-8c43-cd1ffe4a3eab/the_crown_season_4_episode_1_fact_check.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e2a2cbe-6c53-4065-949c-8e1f2625e140/ruxebipexagudejamo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ab1acb19-7239-44de-860d-591f2f7a5a87/map_skills_worksheets_middle_school.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eacb654a-a34d-4ac2-acc6-1e7adeb76f78/cricut_expression_2_connect_to_internet.pdfIn PDF document text
    • https://s3.amazonaws.com/legapatatezisa/brave_new_world_revisited_essay.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4d2b3d7e-b9c0-43d4-92a6-794886d44809/levetisoj.pdfIn PDF document text
    • https://s3.amazonaws.com/xopugup/43738158568.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a082c4c9-1bc9-4a6c-b66e-6502999db7b4/97944811358.pdfIn PDF document text
    • https://s3.amazonaws.com/busutafitufe/kiruxoji.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d0f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD0F9 5380 bytes
SHA-256: 13ebf54936972bed19d3f2d9dcff4196ea71327abdcfb091199433586164cf6a
font_01_sfnt_off0000e343.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE343 11500 bytes
SHA-256: 830d6c44215230a96770928b9dfadd56fca8e00a33fa8a31dce2c901ef3eed2f

Open this report in the interactive analyzer, or submit your own file for analysis.