Malicious PDF — malware analysis report

Static analysis result for SHA-256 28af2043b3ed7dc9…

MALICIOUS

PDF

72.2 KB Created: 2021-06-04 13:14:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 2340cd0ff6f684de8d5c9a4584329c3d SHA-1: 123ffc19c3684af212a8a19d49c73b6ac47eef3f SHA-256: 28af2043b3ed7dc980b95fccf80cec39e08052556410c65a67667103330d2870
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://oniceh.ru/pbw?utm_term=how+to+cite+a+website+in+text+mla+example PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4408483/normal_603901bc3098a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384820/normal_606c0f43a92a7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495558/normal_60356320866ca.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487194/normal_601ae1e6edb91.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4484818/normal_5fdedc8a44379.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4447641/normal_60b62c347cdb6.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4457862/normal_60b08dff92ec0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450721/normal_60080a958c5d9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/864cf0bf-032f-4a9b-9b79-474325a4a9d8/9th_grade_reading_comprehension_passages_with_questions_and_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ea4c302-f663-418b-bebe-bc4efdcd99a4/9718834567.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9a072831-b136-4eb6-b212-d6997b5e7015/21184054934.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4fdc61af-8c68-4f1b-a76b-ccf1f43e68ae/descargar_anthony_santos_popurri_vol_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd8f1bf5-36be-43c2-aa0f-042c61e99521/casio_sgw-500h_manual_espaol.pdfIn PDF document text
    • http://negaboxa.pbworks.com/f/what_is_the_history_of_iron_deficiency_anemia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/63cbc21a-d682-4feb-8200-ab7ecd3c7cec/how_to_stretch_lower_back_scoliosis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/502d1b25-e943-4a40-9701-1a490090620c/sony_bdve3100_5.1_channel_home_theater_system_manual.pdfIn PDF document text
    • http://xelivolofuso.pbworks.com/f/gobivewenodefifuwevuzuma.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e71631c-3d16-44d1-acdc-6f5a084c1419/what_is_angel_number_805_mean.pdfIn PDF document text
    • http://vawaguzidatu.pbworks.com/w/file/fetch/144427227/77776924278.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC2E 5244 bytes
SHA-256: 5a7bce3f90e4578f85691d45ae1570da89b8435347a11ba270d5725f95a6f676
font_01_sfnt_off0000ee02.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE02 11208 bytes
SHA-256: 1685a2791d160c2c4b90f086c01d5a39c0f6ecd32e420592b6a8374818efa6c9

Open this report in the interactive analyzer, or submit your own file for analysis.