Malicious PDF — malware analysis report

Static analysis result for SHA-256 258a3e38194f9693…

MALICIOUS

PDF

73.9 KB Created: 2021-03-24 22:57:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-01
MD5: da431152259ab470c2597aeb03e08c39 SHA-1: b83f14ab270edee302462b66fe32165923034867 SHA-256: 258a3e38194f9693143d930534ccfdbe9a34b96e9c15c24055e3fceeefe3b92b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/wix?keyword=pangea+puzzle+worksheet+middle+school PDF link annotation
    • https://cdn.sqhk.co/xovatagemi/hih7Dif/gta_san_andreas_cheats_mobile_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/vakamuzawa/btjejfl/soccer_kick_game_world_record.pdfIn PDF document text
    • http://jafebidit.getenjoyment.net/topaxuverulus.pdfIn PDF document text
    • http://9gusevshop.website/vilter_compressor_manualg9kxc.pdfIn PDF document text
    • https://cdn.sqhk.co/borefigux/hdVygh5/mesidemaluzuluzumefi.pdfIn PDF document text
    • http://jonebukusopovet.mygamesonline.org/85441012706.pdfIn PDF document text
    • http://lemakomude.sportsontheweb.net/33570885132.pdfIn PDF document text
    • http://thepropheticapp.com/dezekapw7cl.pdfIn PDF document text
    • https://cdn.sqhk.co/kagaxavog/egdhhge/gazinko_drop_pinball_machine.pdfIn PDF document text
    • http://jasapremium.xyz/53579342648sied.pdfIn PDF document text
    • http://disconto50.info/10_verbos_conjugados_en_ingles_y_espaolkyj5h.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/povodijirig/miss_universe_philippines_2017_question_and_answer.pdfIn PDF document text
    • https://s3.amazonaws.com/rizoli/grade_1_and_2_math_worksheets_printable.pdfIn PDF document text
    • https://s3.amazonaws.com/nigimul/pronunciation_guide_for_scientific_names.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0dab30fb-cc23-4140-9646-74e8655eadd4/stihl_battery_trimmer_and_blower_combo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5719b055-c45d-48d4-8984-59e2d64114f8/84979470166.pdfIn PDF document text
    • https://s3.amazonaws.com/visagogijulep/boanstvena_komedija_hrvatski.pdfIn PDF document text
    • https://s3.amazonaws.com/genedesowul/jumprope_app_review.pdfIn PDF document text
    • https://s3.amazonaws.com/zukogi/sickness_in_pregnancy_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/labitajaxatufib/retire_early_with_real_estate.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e19a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE19A 5692 bytes
SHA-256: 469b087d05c6e5540e037e8bf01b7616ab8238acfb3cc3ec49c7a2b51d517ec9
font_01_sfnt_off0000f4f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4F1 10984 bytes
SHA-256: 6c753c671206f714261f92233f08a0dce4c1f94814177beb097c683fb78630f0

Open this report in the interactive analyzer, or submit your own file for analysis.