Malicious PDF — malware analysis report

Static analysis result for SHA-256 22d95609aa80a752…

MALICIOUS

PDF

91.2 KB Created: 2021-05-19 12:53:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: e36eb3a1334d6004f8b000ec7161178f SHA-1: 5eaa23cfe19a45c7064c1ad77b5080d87f6d0f96 SHA-256: 22d95609aa80a75288869777dedb238d7e574a47e566df07e3a41c77957a8c8d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=why+won%2527t+my+nespresso+milk+frother+work PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/513350a3-a821-4dcb-a248-7f79c555ecd3/67139938162.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e017049-977e-4219-8ad5-035b1ffa4699/electronic_circuit_design_software_free_download_for_windows_7.pdfIn PDF document text
    • https://s3.amazonaws.com/figugipopar/appointment_form_for_passport_renewal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/542d7f90-6067-418b-acee-409200e81da2/jevoxeli.pdfIn PDF document text
    • https://s3.amazonaws.com/jutenojamega/xidigaranarapugevap.pdfIn PDF document text
    • https://s3.amazonaws.com/votubukaxogilix/skull_trumpet_sound_effect.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e1a85834-cc5b-4fc2-9622-9149ed3baa7a/why_does_my_house_phone_have_no_dial_tone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b53dcc2d-7dbe-4e48-b608-5218635d9661/33006345406.pdfIn PDF document text
    • https://s3.amazonaws.com/ditiruz/vulemor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ab2d76d0-c096-4f1f-a23d-6b4a8ad87cd6/dish_network_phone_number_for_customer_service.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9822d3fb-332f-4814-824a-3dc25d340a7a/21886875529.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d51bdac-4b9e-41b6-8fb2-800f88eca6df/gawogesimovurejexunuta.pdfIn PDF document text
    • https://s3.amazonaws.com/pevuwarobuvowa/shrek_2_opening_book.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1da307fb-a43f-444e-be03-b8d2ac08c898/coleman_mach_rv_air_conditioner_not_working.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/277d4260-3c8f-4762-a97b-cc7b6e1f029b/17999412944.pdfIn PDF document text
    • https://s3.amazonaws.com/fomaralunex/62695864500.pdfIn PDF document text
    • https://s3.amazonaws.com/nowonovege/birthday_messages_for_friends_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/498945e2-e94c-4189-8e22-1a95345a4d55/islamic_names_dictionary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2bb56d10-9dc5-4c64-9e1a-a273a70342c6/what_size_are_stackable_washer_and_dryer.pdfIn PDF document text
    • https://s3.amazonaws.com/fotojipifuzitul/double_bed_sheets_target.pdfIn PDF document text
    • https://s3.amazonaws.com/divelikubapiwaj/archicad_18_free_with_crack_mac.pdfIn PDF document text
    • https://s3.amazonaws.com/bulujono/22641225315.pdfIn PDF document text
    • https://s3.amazonaws.com/xabalaru/boy_scout_uniform_patches_for_sale.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000125bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x125BC 5236 bytes
SHA-256: e0c72b83ab9ce053ca2c8a24e25ca8ec9445a15b159a467a5430c510c4721574
font_01_sfnt_off0001378b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1378B 11740 bytes
SHA-256: b3a1db1ef7061afc58cf694edec386ca30ee30ab8e6a20f093e3dfecea0693da

Open this report in the interactive analyzer, or submit your own file for analysis.