Malicious PDF — malware analysis report

Static analysis result for SHA-256 23d12e5fd1abfaff…

MALICIOUS

PDF

75.4 KB Created: 2021-06-06 04:17:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 94e58fbbfbb7aed02d0d98d0149821dd SHA-1: 70aec321aab15385ce6c524d4e648b14575d1231 SHA-256: 23d12e5fd1abfaff65575298772bedfcbe93aa4d007ddeb610f6795bbedd5433
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wastran.ru/pbw?utm_term=andrew+heywood+political+ideologies+5th+edition+pdf+free PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4413242/normal_60b7ef35155dc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459479/normal_600b4a953da95.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4403561/normal_60b2779f7379f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380403/normal_60b9f513eda0a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://wikitaxif.pbworks.com/f/how_to_create_theoretical_and_conceptual_framework.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5349334f-7da4-4710-8fd2-77cc6e9a6394/zojez.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd52a4a9-bef6-4b67-b9e4-717c1d271ee1/papas_scooperia_hd_free_download_ios.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e79dddc-91b5-4c7a-87c8-41eab034f05e/gekulux.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a689dc5-6215-4812-9ba6-bfda7e2144f7/2492961323.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/51b0aeab-5eca-4112-ae03-faa42b3eed16/reported_speech_exercises_with_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b465ac7e-ec02-405d-a633-c39036523644/las_medias_de_los_flamencos_resumen_muy_corto.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4608104c-a8bc-42bc-8bc3-a714ceb2530f/romeo_and_juliet_movie_2013_plot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b45bc6cd-4bac-473a-8559-a0921eb4649a/angularjs_bookmark_pages.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/63d5177f-0f30-4574-95ec-508c08eb7854/dawesas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fd367b31-bfcd-4053-a8d0-f4587050a41f/proform_performance_400i_treadmill.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cefb3c42-de15-489f-95e9-25123d82d78e/the_raven_by_edgar_allan_poe_critical_analysis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6cafd24c-5166-495f-a019-f4e64c2e286b/siximi.pdfIn PDF document text
    • http://gozuwef.pbworks.com/w/file/fetch/144524319/peaceful_warrior_full_movie_in_hindi_dubbed_free_download_worldfree4u.pdfIn PDF document text
    • http://letonepamusi.pbworks.com/w/file/fetch/144437307/16800997172.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b39d5fd7-1a0d-4802-a4e9-04f31601c991/what_is_the_definition_of_agricultural_revolution.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4399aa26-a765-49ca-a81e-e2e78e4cea9b/vortech_mp10_wet_side_disassembly.pdfIn PDF document text
    • http://tereburokofe.pbworks.com/f/borg_rating_of_perceived_exertion_rpe_scale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5fc3cfea-1782-470f-a4aa-c2943e975877/what_are_the_steps_involved_in_balancing_a_chemical_equation_explain_with_an_example.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/50e88a87-798c-4be7-a83d-57e1989c4ab3/sc_hope_scholarship_requirements_2019.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4AF 5724 bytes
SHA-256: 388d9cb89ebe4766827d15f25eb49daf645ba3e2e578fd841ba8cc9df103ec9f
font_01_sfnt_off0000f84d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF84D 10956 bytes
SHA-256: 37964d14324dd85a74f1e43e22bbe53b3ff3a94ad751772a9519ecd2f77bcef6

Open this report in the interactive analyzer, or submit your own file for analysis.