Malicious PDF — malware analysis report

Static analysis result for SHA-256 271d86d715ce3ebf…

MALICIOUS

PDF

76.8 KB Created: 2021-03-24 00:37:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 643072cba717aa559907180333ece0f2 SHA-1: 8f1177aac52e52a0277910c0fde16c2827da506a SHA-256: 271d86d715ce3ebf76c83eaebeae7318e61304e96d2d58767ad129b704408420
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/wix?keyword=community+schools+nyc+jobs PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4390381/normal_601e2c0827de0.pdfIn PDF document text
    • https://cdn.sqhk.co/paleguvebo/imtijMj/patrick_wilson_superhero.pdfIn PDF document text
    • http://dommasters.site/duxegotuzan4uzo4.pdfIn PDF document text
    • http://premial.su/the_natural_book_vs_movieuqp0g.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420906/normal_60299ff6b4e8f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375199/normal_602cf372b1993.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449777/normal_604874737f4fc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450506/normal_5fd9221d5ee53.pdfIn PDF document text
    • http://prechambre.xyz/rokegunizukirodikixwrtkx.pdfIn PDF document text
    • https://cdn.sqhk.co/sirepajaku/hnJPAmU/march_of_empires_assistant_apk.pdfIn PDF document text
    • http://kozlo.space/kusogejixagapeli4mlk7.pdfIn PDF document text
    • https://cdn.sqhk.co/lididiregi/idjgGhd/xazonosajoxa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/fe572630-e269-43b4-a46d-043950b2ffea/bevupu.pdfIn PDF document text
    • https://s3.amazonaws.com/napoledunadigo/27017054394.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89617f1f-b5fd-4a30-97f5-32eb3660c1cb/portfolio_outdoor_lighting_replacement_bulbs.pdfIn PDF document text
    • https://a6f18165-9bfd-46c9-8f51-0ab50cd0b687.filesusr.com/ugd/265c7a_d3b1574f9db24a45b5c2b47ec89a01fc.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/billie_s_bounce_lead_sheet_bass_clef.pdfIn PDF document text
    • https://s3.amazonaws.com/tibitexil/zuxem.pdfIn PDF document text
    • https://ee6bc897-aa08-459d-b6e6-b1b1d69fcba1.filesusr.com/ugd/7ba596_814862bb1efd48b09759e7d4f92222bb.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/juzowilipi/pokemon_drawing_book_online.pdfIn PDF document text
    • https://s3.amazonaws.com/kevava/pizamatapupatun.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f106.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF106 4956 bytes
SHA-256: a0db2a129c802baec7d74f6eb87b9eeb9b577fefaf9d2cabebbfd20451340ede
font_01_sfnt_off000101cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101CF 10544 bytes
SHA-256: 7a45344400e9a48fa3cd33b8ea2588f6a86f304bbe7978dcd2616cba73d49a2a

Open this report in the interactive analyzer, or submit your own file for analysis.