Malicious PDF — malware analysis report

Static analysis result for SHA-256 24fcaf21fa1d77ac…

MALICIOUS

PDF

196.7 KB Created: 2021-03-31 04:11:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: d1369eb58d9e7844fb93a5be70ec76db SHA-1: 51a9e5c2b2beff1f4b5a99409b4d35c2b4016ff4 SHA-256: 24fcaf21fa1d77ac545f110081069474df569837723a518b9eacba50a8f73d76
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=warrior+guide+gw2 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4366980/normal_5fe7102f84b1f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4451945/normal_5ff61f5d2fe3f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464319/normal_6028a57656513.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384039/normal_5ffd4ba663d13.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379968/normal_600e4412ae4af.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374533/normal_5fe6df519637e.pdfIn PDF document text
    • http://xagakojitogiva.getenjoyment.net/sewirokamivivab.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481280/normal_5ffdb2a21e087.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367299/normal_5fd2cb4d3367d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366377/normal_5fdb98a5d70f0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://76df98a8-3e94-4eee-a6f5-23e1de06049b.filesusr.com/ugd/54c74c_df33a6a8fb624d4aa36f304da03b7e46.pdf?index=trueIn PDF document text
    • http://kapowuxivi.atwebpages.com/business_model_canvas_a4.pdfIn PDF document text
    • https://a24bc4ef-4ee2-4fae-af0c-c9fea810b245.filesusr.com/ugd/67d96c_c839d04753e741a6b9445b80cfe55bba.pdf?index=trueIn PDF document text
    • https://90138cf2-752b-46b9-a396-1872e0473e42.filesusr.com/ugd/02203e_f181cc8cd08443ecbe7ee2066c7d8cc1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gafedupeba/how_to_help_psoas_pain.pdfIn PDF document text
    • https://s3.amazonaws.com/muvazi/pinotigob.pdfIn PDF document text
    • https://8d94caac-80d5-4f6d-a73a-04ed47837dc1.filesusr.com/ugd/585b1d_8a4c585111fd494086237a6b7989bbd7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nefomojuwet/the_cask_of_amontillado_summary_slideshare.pdfIn PDF document text
    • https://a519209a-2b0a-481f-9fe9-460c873bdc80.filesusr.com/ugd/270e53_059cc0c6f8e74ddb93909e83ff807929.pdf?index=trueIn PDF document text
    • https://c36efdde-2309-4ce2-a10d-b6df2ce12cd8.filesusr.com/ugd/e98059_400401f9e3a448a28e35bcb69b897dbc.pdf?index=trueIn PDF document text
    • https://8a5a474a-a671-4857-921d-d1df0ee72544.filesusr.com/ugd/523716_f92853ff87574de7b053269c2aae6034.pdf?index=trueIn PDF document text
    • http://rabelame.atwebpages.com/baradit_libros.pdfIn PDF document text
    • https://s3.amazonaws.com/vidadaviwal/19897367133.pdfIn PDF document text
    • https://156bb51f-0b62-477f-88ca-8620af00812b.filesusr.com/ugd/e3ff21_ad94ba3987464df3b1abb9ee57db97ea.pdf?index=trueIn PDF document text
    • https://4c72699b-aa2e-4dc8-8bd5-1a54e8f938a6.filesusr.com/ugd/f3cb45_4066ee07f0894fd8bea9f75f568b3c88.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002cbfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CBFD 5020 bytes
SHA-256: 3f78321d6b8a5b7dc5069d0d6e00b59d831244102929a2af254f142c4f4bcf20
font_01_sfnt_off0002dd38.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2DD38 11552 bytes
SHA-256: c75ae84985f366f1f2fce69213602f2cd4a1b91479b2292c398937eff08d861d

Open this report in the interactive analyzer, or submit your own file for analysis.