Malicious PDF — malware analysis report

Static analysis result for SHA-256 363e2e449860bab6…

MALICIOUS

PDF

78.9 KB Created: 2021-03-11 09:51:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 2e1167d3dc15535f1db4d4529036739c SHA-1: 91716ae255bb1e0ea81ed7a73883754f30d2c475 SHA-256: 363e2e449860bab6072160390634ccb60415cffd4f9ea9dfc046503a570198a1
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/wix?keyword=manual+de+fotocopiadora+konica+minolta+bizhub+350 PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4369491/normal_5fceb076314d7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417024/normal_5fd6387a0dac6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4488817/normal_5fff3f56a97fb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4467325/normal_5ff6690e1f275.pdfIn PDF document text
    • https://cdn.sqhk.co/tibakekavero/H0hggf0/91570709505.pdfIn PDF document text
    • http://songkfrk.site/28587066044fir57.pdfIn PDF document text
    • https://cdn.sqhk.co/lijuwezasip/geghjb5/pokezibesugawowuguvuxawam.pdfIn PDF document text
    • http://dalnoboyi.xyz/xujodusopilekeg4a2rc.pdfIn PDF document text
    • https://cdn.sqhk.co/bagadogod/hjcQia2/ninja_warrior_assassin_3d_mod_apk.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421630/normal_5ff0e4bed1f0d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426966/normal_60396646b10b7.pdfIn PDF document text
    • http://newberginvestmentproperty.com/36512326947qeoul.pdfIn PDF document text
    • http://kvyovk.xyz/e_myth_booksxcg6l.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413375/normal_5fc756072fdd6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366337/normal_5fe348fbeab49.pdfIn PDF document text
    • http://helpverifedbadges.com/53335014273ludj6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486201/normal_6000d3efc17b9.pdfIn PDF document text
    • http://idslim-italia.site/fuxufosufetbms6r.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377925/normal_5ff5b40c510de.pdfIn PDF document text
    • https://cdn.sqhk.co/ropimipaf/iF7VHKj/clockify_chrome_extension.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408343/normal_5fe8069b07468.pdfIn PDF document text
    • https://cdn.sqhk.co/patagarinixa/eghjcA1/house_electrical_wiring_diagram.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9C8 5788 bytes
SHA-256: c380af689c43fc6a76574ecbc42ea00ff2454e7bfebf8eed4e5080f6cd197992
font_01_sfnt_off0000fd54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD54 9972 bytes
SHA-256: 9ded0b12d859ab06f08ac986aae1d41c8b85016bea30718ed2ae64354e69f813
font_02_sfnt_off00011f96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F96 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.