Malicious PDF — malware analysis report

Static analysis result for SHA-256 3dc12f7c7a477c78…

MALICIOUS

PDF

106.9 KB Created: 2021-03-11 11:08:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: a93502ed7d40522fb282938cfc1cafd6 SHA-1: 9cd559afb4e4dfeb6a42ce4158119d12290ffa71 SHA-256: 3dc12f7c7a477c7871a2e903320de5baf1cb4f18a7469adcedf343fe230dd88c
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=assessment+of+learning+pdf+in+tamil PDF link annotation
    • http://ludirobus.getenjoyment.net/neliwumerawot.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412593/normal_5fcfe7dc941f2.pdfIn PDF document text
    • http://xiwakaravivomik.scienceontheweb.net/how_much_does_a_program_manager_make_at_amazon.pdfIn PDF document text
    • http://warupipujamoru.sportsontheweb.net/what_are_the_3_types_of_conflict_in_psychology.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387698/normal_6030212cb83ba.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4404755/normal_5ff2731e28daf.pdfIn PDF document text
    • http://lizoguxumugef.mywebcommunity.org/public_speaking_tips_for_students.pdfIn PDF document text
    • http://zegiwire.sportsontheweb.net/amparito_roca_partitura_flauta.pdfIn PDF document text
    • http://peramabejakes.sportsontheweb.net/boat_origami_instructions.pdfIn PDF document text
    • http://tonedomopoja.scienceontheweb.net/us_navy_diver_insignia.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369782/normal_5ff05b880d6cd.pdfIn PDF document text
    • http://digovin.getenjoyment.net/alfonsina_y_el_mar_ariel_ramirez.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://nejesezape.myartsonline.com/how_to_format_a_screenplay.pdfIn PDF document text
    • https://s3.amazonaws.com/vavale/dajuzajudisokujobo.pdfIn PDF document text
    • https://s3.amazonaws.com/vitelitubovuluj/vcds_lite_loader_exe.pdfIn PDF document text
    • https://s3.amazonaws.com/dowesitobuga/tebupewupupofidam.pdfIn PDF document text
    • https://s3.amazonaws.com/falevi/smallest_4g_android_phone_in_india.pdfIn PDF document text
    • http://nununad.myartsonline.com/94603335897.pdfIn PDF document text
    • https://s3.amazonaws.com/betefowubevat/7th_grade_math_worksheets.pdfIn PDF document text
    • https://s3.amazonaws.com/nevovumowa/allahabad_high_court_aro_exam_paper.pdfIn PDF document text
    • https://s3.amazonaws.com/nijosinizo/levumufajozuxisera.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000159b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x159B4 5136 bytes
SHA-256: 0a548887ba3e6d8b808b093bb44bab672a8ff1c513a92c01d60e2efd49dab58b
font_01_sfnt_off00016b10.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16B10 10560 bytes
SHA-256: db61b35068f4fcbcdf23b0c55a9d9f4ec540fa1207c35a055d6b1d575c1ba6bf
font_02_sfnt_off00018f1c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18F1C 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.