Malicious PDF — malware analysis report

Static analysis result for SHA-256 32ffb5db2a474427…

MALICIOUS

PDF

74.2 KB Created: 2021-03-29 16:54:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: a1109aa88590eeb55ea0122708403e33 SHA-1: 5eaddc0ef94271e0ce6315107a2af8f34f26ae9f SHA-256: 32ffb5db2a4744276a70a46b47b01163bbdd742f8ebc5cb866a67531db0622fc
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=advanced+excel+formulas+2020+pdf PDF link annotation
    • http://liketime.online/18365283218glxmp.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377706/normal_60580451d1ab1.pdfIn PDF document text
    • http://help-bluebadgecenter.com/zusuvhknt5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4495402/normal_5ff42ca6d199e.pdfIn PDF document text
    • http://lnstagramverifiedsbadgeform.com/28840303452mj3iz.pdfIn PDF document text
    • http://goodsfor.life/dilabumipugomuwebigiroxogc2zxx.pdfIn PDF document text
    • http://about-central.com/75313527200lulb7.pdfIn PDF document text
    • http://ptmonline.ru/sulise1r13i.pdfIn PDF document text
    • http://pushbiz.fun/80132103038v5dkt.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403120/normal_6015cb02cc3f3.pdfIn PDF document text
    • http://trellos.fun/67668825336q12wt.pdfIn PDF document text
    • http://verifybadgesbusiness.com/11320357816w70br.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rebesudanolo/best_video_converter_for_android.pdfIn PDF document text
    • https://s3.amazonaws.com/robumuduluwise/56477498342.pdfIn PDF document text
    • https://ee897e78-a157-4eb5-8a47-d615096087a2.filesusr.com/ugd/113e89_ddec813045d846fa89506cb37f20f25e.pdf?index=trueIn PDF document text
    • https://22e365c6-0853-42e1-82f8-83473bf9c0bf.filesusr.com/ugd/217d68_e19cba873d6f4051ad5d937828cee255.pdf?index=trueIn PDF document text
    • https://a513df27-8ea1-49e5-9b48-af726a3c99b5.filesusr.com/ugd/c567c1_5fa1b438f3cb470b96a5d00dbc8b44b4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/busutafitufe/ritituwigitun.pdfIn PDF document text
    • https://s3.amazonaws.com/pivetuzadujo/58320952207.pdfIn PDF document text
    • https://s3.amazonaws.com/tabobujimo/23749511790.pdfIn PDF document text
    • https://fccd5518-64e1-462d-9dbe-8d8d8a19ca7a.filesusr.com/ugd/eb005d_a20feb77e3344a81b47bd7589fa6ea94.pdf?index=trueIn PDF document text
    • https://1bf92926-22d0-44a1-94fb-b51843c41cd5.filesusr.com/ugd/762c1a_c46738a1e5b1408686b3282a5684327d.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ded8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDED8 5692 bytes
SHA-256: 8dc30f4851882aff80f5376909d643bee1a807f895b8815e266f17529b96e1ab
font_01_sfnt_off0000f22f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF22F 11612 bytes
SHA-256: 5c970aa495641103f59d96074e52ab57fef3a5e8ed3f88e1bda3462c46846e35

Open this report in the interactive analyzer, or submit your own file for analysis.