Malicious PDF — malware analysis report

Static analysis result for SHA-256 3556165608e931a2…

MALICIOUS

PDF

75.3 KB Created: 2021-05-30 23:11:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: be398055936aeb75a76f83dbe1be7d4f SHA-1: cf75ddfc5a360f960e9ec19ff57c659915d1b437 SHA-256: 3556165608e931a2941b062b3fd0532f1d3aab72dce7c71ef62c273bdb348d6a
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses an urgency-based lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=how+do+you+replace+the+ice+maker+on+a+frigidaire+refrigerator PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4409602/normal_6010dd43339eb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469136/normal_60607b5badbd0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4488560/normal_5fe026ff9b955.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386347/normal_6013f61bf1122.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369793/normal_601d6ac20b04e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4478685/normal_5ff1519e4e9ba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409122/normal_606e45f47ab5e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381297/normal_5fccfd8dc9695.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/af38c310-8c28-499a-95ce-498902228c63/62221898845.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9c015a6-bd8b-433d-8314-b23da2cf5cd7/96700685562.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6ec10594-eb81-4b0b-a457-3f41764127e3/how_to_grow_tomatoes_from_seeds_in_florida.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/551072ad-4fc1-4a7c-b7bb-0d184f06b32f/3d_warehouse_sketchup_2019_crackeado.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/39220ad5-9f91-4697-a38f-327cf3091a81/cruz_roja_polanco_cursos_de_primeros_auxilios.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/703bfe11-5614-474c-9b13-cc2b67fba753/can_you_get_a_covid_antibody_test_at_kaiser.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e108d5c9-e752-4f0e-9f9c-ab7ecac41c2e/the_wrath_and_the_dawn_series_how_many_books.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/98e354ec-931e-47c3-8177-4a78853b5630/35107043845.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/973420aa-6b4b-4b56-97c0-4904acb47b04/wayne_dyer_books_amazon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f868e285-bde4-46da-ba12-4a5c2102ee4d/61645037118.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c02e64a-3aa0-49ea-b653-b0ae5434abea/rutiseketolik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c523581d-6242-493a-a0a1-883b454261e7/japer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1847e23-2bb9-4dbf-a33f-0a9cf5b4dcbf/do_dollar_general_employees_get_holiday_pay.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc8e3812-3cf2-46b9-8cf9-ff3731ae3517/42944169980.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e47b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE47B 5608 bytes
SHA-256: e0fa76c655581d5a5b4a7cd7da71c4e01975a8b789d7195169a95593be5ed952
font_01_sfnt_off0000f782.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF782 11716 bytes
SHA-256: c5048d70fd182f9927b4c6ff4442f277bd09d695015c023731262774634b4a14

Open this report in the interactive analyzer, or submit your own file for analysis.