Malicious PDF — malware analysis report

Static analysis result for SHA-256 30907a86b205029f…

MALICIOUS

PDF

70.0 KB Created: 2021-03-26 07:27:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 0cc74a5f50576aae8bc3d25330efee0d SHA-1: 20f8fc0fc797ae11d9b163a18cb5dc83ecdf9f5d SHA-256: 30907a86b205029fe17dba6d942667ef508c8e2c76b6632e04f894dba8a5a840
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/wix?keyword=vocabulary+workshop+answers+level+c+unit+5 PDF link annotation
    • http://vazifesi.iblogger.org/harley_davidson_softail_2010_service_repair_manual.pdf.pdfIn PDF document text
    • http://sesulede.iblogger.org/how_do_i_reset_my_liftmaster_garage_door_opener_keypad.pdfIn PDF document text
    • https://muruvarulem.weebly.com/uploads/1/3/1/4/131406835/bonegowek.pdfIn PDF document text
    • http://cocobuka3.xyz/the_heiress_movie_1949ywyi4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476152/normal_5ff524015f237.pdfIn PDF document text
    • http://reabook.online/37529851912ghkok.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412575/normal_602521c267fba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409092/normal_603d0e7c034b5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365607/normal_605ca7a4327bb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382406/normal_603be02283921.pdfIn PDF document text
    • http://optalpha.com/45356874180r8wg4.pdfIn PDF document text
    • https://xikemusuvef.weebly.com/uploads/1/3/4/3/134322181/wofugu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vavebufevodutob/311819167.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2cb0b39c-5ef4-47e7-b55d-86f7f00bf81b/jijibalegotiwoxewejode.pdfIn PDF document text
    • https://s3.amazonaws.com/rivazixexuguri/best_free_spell_check_app_android.pdfIn PDF document text
    • https://s3.amazonaws.com/lomiwexuva/rudefuxujopimubimekumedu.pdfIn PDF document text
    • https://s3.amazonaws.com/mefovu/como_es_un_lider_carismatico.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48079528-2782-442d-86ca-400e4d8dc9c4/panasonic_phone_manuals_kx-dt343.pdfIn PDF document text
    • http://popudedakajani.rf.gd/email_etiquette_free_download.pdfIn PDF document text
    • http://balubusepebibi.rf.gd/mavufur.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e57c5ed-7fa9-4fd6-ba14-79850279a4da/zadapuxotopujalewep.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/812c0b8b-6b07-4353-92f8-d64be639d400/3406021449.pdfIn PDF document text
    • https://s3.amazonaws.com/zasepo/how_big_is_the_parallel_parking_space_on_the_driving_test_in_mn.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ad46caa-b390-4025-aab8-b93684d7acbd/vofib.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d6a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6A4 5568 bytes
SHA-256: 2adfc2e7464f8df4e60fdee11ac75b27bc393e7a8055edaf86a9542a84d78639
font_01_sfnt_off0000e9ae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9AE 9568 bytes
SHA-256: 78d95ac82bea20ea53c0382db70b7c66d768def667e78cfffce428f0bfd92b07

Open this report in the interactive analyzer, or submit your own file for analysis.