Malicious PDF — malware analysis report

Static analysis result for SHA-256 2cd0fe75ff794ed5…

MALICIOUS

PDF

73.2 KB Created: 2021-03-19 04:27:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: a9b02d8f3b0f612f5b39ae8e38b278ea SHA-1: 9dd32c90b34f04e9312b2599f370d807c3a9f541 SHA-256: 2cd0fe75ff794ed5adfefc2ad34b90a6d6e09592bcfa3c80f9a5ed328f43103b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/award?keyword=child+development+and+pedagogy+pdf+in+tamil PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4446773/normal_5ffbd9542b496.pdfIn PDF document text
    • https://cdn.sqhk.co/xubupigegi/Qjdhfij/hop_ball_3d_apk_indir.pdfIn PDF document text
    • https://cdn.sqhk.co/kuwusemob/Cnjdbf2/international_marketing_notes.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367914/normal_6006e595671d5.pdfIn PDF document text
    • https://cdn.sqhk.co/nuxoporerom/jdxjffu/8964107948.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485172/normal_60092c67e640f.pdfIn PDF document text
    • https://cdn.sqhk.co/vuzowadijavu/ghicjjd/best_pocket_knife_with_glass_breaker.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8277795c-810a-4a73-9cba-c06ed7bf774d/31844024315.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2a8610d-e2ca-4afb-8128-668b2964d408/5719726825.pdfIn PDF document text
    • https://s3.amazonaws.com/zukogi/vafivitetebobanuv.pdfIn PDF document text
    • https://s3.amazonaws.com/penale/jinekenidazalumune.pdfIn PDF document text
    • https://s3.amazonaws.com/tugabijenovili/bradford_city_fire_news_report.pdfIn PDF document text
    • https://s3.amazonaws.com/befafuni/eclipse_oxygen._2_release_4._7._2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc536fe4-0304-4aeb-9f71-eb3960e0ff49/d_and_d_players_handbook_5e.pdfIn PDF document text
    • https://s3.amazonaws.com/wobuzisibal/60417204983.pdfIn PDF document text
    • https://s3.amazonaws.com/jiwisigetizoxif/cooking_level_guide_bdo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/364cc220-d574-4eb0-90f1-d93b365dba52/likafawewanupewagomafuner.pdfIn PDF document text
    • https://s3.amazonaws.com/womirofop/80781090474.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df08.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF08 5248 bytes
SHA-256: b42956643fa832c69a1bd5413a5318e009014b9b1e7cfc3bc5258fd706c5e879
font_01_sfnt_off0000f0d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0D0 11404 bytes
SHA-256: 95f76a3f8d3493e1c8f82808d47e2c7eb485d604e3f3e490cf8ef5ea8d3ef2af

Open this report in the interactive analyzer, or submit your own file for analysis.