Malicious PDF — malware analysis report

Static analysis result for SHA-256 36220aaba2217994…

MALICIOUS

PDF

345.9 KB Created: 2021-03-28 18:56:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: c5d6e39bda0a255de71e0de38a8696a7 SHA-1: b082cccb66cb0c920a0f3d6ae2260116f479e6de SHA-256: 36220aaba22179946da19a0f47e4b71f56978121cc25d2c315876abf46f8c1f5
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9953

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=history+of+pakistan+in+english+pdf PDF link annotation
    • http://wedurorokim.mypressonline.com/rewipatalirixagutiwepanan.pdfIn PDF document text
    • http://itasda.online/temofafosonedavofadov5suwj.pdfIn PDF document text
    • http://deemonatrafik.xyz/qu_significa_la_ley_marcial_en_estados_unidosvc1z5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392193/normal_601d9eff4508e.pdfIn PDF document text
    • http://carinsusa.info/spectrum_math_workbook_grade_8_free92cvz.pdfIn PDF document text
    • http://scoretdho.best/roravunuwonifijuq427.pdfIn PDF document text
    • http://onlinekartiadesi.com/buy_fisher_and_paykel_dryer_partsaxogn.pdfIn PDF document text
    • http://olymptrade.buzz/cambridge_dictionary_of_englishpilmd.pdfIn PDF document text
    • http://gemubanabugawa.mypressonline.com/15515282482.pdfIn PDF document text
    • http://torixewiser.medianewsonline.com/analytical_techniques_in_organic_chemistry.pdfIn PDF document text
    • http://teaitalis.space/28306613871jftbl.pdfIn PDF document text
    • http://vedice.ru/t-fal_deep_fryer_with_basket_stainless_steel_easy_to_clean_deep_fryer_oil_filtration_2.6-poundshxdv.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405687/normal_601cad047946f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369323/normal_60192cebf150a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/furunumaroxun/38247800391.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2b05816-d445-480b-9cc1-03a5cfe5c030/future_english_for_results_2nd_edition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a23f37b-4325-4d4a-ab38-276328232928/2675329636.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/602e2c22-9093-4b09-9490-31267a840cdf/how_to_adjust_rollerblade_adjustable_skates.pdfIn PDF document text
    • http://samesesodore.onlinewebshop.net/14498945218.pdfIn PDF document text
    • https://s3.amazonaws.com/sefipa/too_big_to_fail_movie_free.pdfIn PDF document text
    • https://s3.amazonaws.com/nisoxow/mawobuvadufupivivigukax.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00052228.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x52228 5428 bytes
SHA-256: b14e8a3260e87941c0fa32b45b88808ba8e719770a4a294b012e5bf387bc1354
font_01_sfnt_off0005349d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5349D 10656 bytes
SHA-256: 9f5384f49062828544cf66778b0f5ae72b1bb8a5fd35e632b743747e18d47f3f

Open this report in the interactive analyzer, or submit your own file for analysis.