Malicious PDF — malware analysis report

Static analysis result for SHA-256 2eefa7569f0235ea…

MALICIOUS

PDF

69.2 KB Created: 2021-02-18 16:33:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: edcd7e89d04a8309ac604bf88caa4709 SHA-1: 6c74b8566efb3b37bc02aaa0460d92a9e8b115d3 SHA-256: 2eefa7569f0235eaccdeb1ad65cd96c184dd216c173b8184b1ef5e8b4737d3ef
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=hard+reset+asus+router+rt-ac68u PDF link annotation
    • http://itdiscount.info/ridinogiperugigivisukmygy9.pdfIn PDF document text
    • https://cdn.sqhk.co/femaxozimom/jhdia9f/balenciaga_bags_2020.pdfIn PDF document text
    • http://mon-cmb.best/148886994309tbhi.pdfIn PDF document text
    • https://cdn.sqhk.co/pumibavi/5jgMifC/pokemon_home_app_ios.pdfIn PDF document text
    • https://cdn.sqhk.co/sadudolamom/hjSxihe/zulin.pdfIn PDF document text
    • https://cdn.sqhk.co/fuluzagile/icBicif/nuxatevan.pdfIn PDF document text
    • http://unityfree.xyz/android_developer_settings_shortcut5sckz.pdfIn PDF document text
    • https://cdn.sqhk.co/fumodolanes/hifYTHi/65516548897.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403537/normal_600e2414df669.pdfIn PDF document text
    • https://cdn.sqhk.co/mekaxosur/gc2iiWI/century_arms_c39v2_stock.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403273/normal_5fe3b4c0c15e4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4505837/normal_602c4e9b2c914.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://xunaxutuwu.rf.gd/tafopaj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d318.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD318 5244 bytes
SHA-256: 20121481d2b62769c2ef546a9dfd8a2dce2d3864400a3f2fc2670659956302b5
font_01_sfnt_off0000e4f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4F9 10308 bytes
SHA-256: 7b2341e2c2ecac0f15de4ceaca5ea8e1e08632a44c5687f222e4d50d49f6722f

Open this report in the interactive analyzer, or submit your own file for analysis.