Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f8b5facce5fe137…

MALICIOUS

PDF

153.9 KB Created: 2020-11-11 06:09:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 992c51558ef86a47c6feb59514218b98 SHA-1: dfacd190ae8759b7b5892ff2a9ff2da56ba1951c SHA-256: 3f8b5facce5fe13742ebcc5b61db4f22bdeb5e5486da2ff0785549544b50552f
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/aws?keyword=all+trig+identities+formulas PDF link annotation
    • https://dawanuma.weebly.com/uploads/1/3/4/3/134305997/bizok.pdfIn PDF document text
    • https://gofolonuk.weebly.com/uploads/1/3/4/3/134313710/kapawe-kodixa-mebepumari.pdfIn PDF document text
    • https://runevivapubate.weebly.com/uploads/1/3/4/5/134595370/busomunanevut_maxizag_koserup_liwudamab.pdfIn PDF document text
    • https://tipefejiri.weebly.com/uploads/1/3/0/9/130969755/d7bfb62f813a758.pdfIn PDF document text
    • https://xemupawiked.weebly.com/uploads/1/3/4/3/134321325/3d41e5e99.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/xedewofuretujo/90977451962.pdfIn PDF document text
    • https://s3.amazonaws.com/somamere/how_to_clear_pm_on_discord.pdfIn PDF document text
    • https://s3.amazonaws.com/pibajuwi/sushi_monster_menu_farmington_ut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e895f68-067f-4a1a-853a-d0c069185c7f/mhw_weapon_ranking.pdfIn PDF document text
    • https://s3.amazonaws.com/vazisi/wesukedojavemubugapizoxim.pdfIn PDF document text
    • https://s3.amazonaws.com/mamibis/phalogenics_method_exercises.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/arihant_neet_books_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/zemigiduwagafu/kivira.pdfIn PDF document text
    • https://s3.amazonaws.com/zidosozawok/carcinoma_de_celulas_escamosas_pulmon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4fd06c02-935f-47f7-9d29-cd21655a2d9d/batch_file_games_color.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/143118b4-ce49-48f5-a933-d3051ea4dee0/viguser.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001ef0c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1EF0C 5096 bytes
SHA-256: 028f8a1a5a57eae5636ea858afbeeb685d5f3824f9d960a039e9dfba5c192fb8
font_01_sfnt_off0002003e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2003E 15952 bytes
SHA-256: b65ce525535ad8db3a9762e05a4a156db139037e7a022cc4616829611157ff13
font_02_sfnt_off000232c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x232C4 17088 bytes
SHA-256: 8b327f729d4c8530f29cdd9bac121224d23ecf79b9a956fc5d989defd6ef80b9
font_03_sfnt_off00024b77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24B77 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.