Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f994d0c97489617…

MALICIOUS

PDF

79.5 KB Created: 2021-05-21 10:23:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: d987c6df904e52a619aad57bb43cc464 SHA-1: c550476343e63883da24ccf523c4a7134f820447 SHA-256: 3f994d0c97489617a08a764cf0843308fceaddfd67a6c2e5e1d7dc5ed90c2299
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=is+the+rn+nclex+changing+in+2020 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4423732/normal_6010feed51ffd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413977/normal_6035397e7fbb5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4475720/normal_5feafe95eb28c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489844/normal_600fbe7639d17.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475217/normal_60488c8f4eed9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pewebopufupe/50_shades_of_gray_movie_hulu.pdfIn PDF document text
    • https://s3.amazonaws.com/tevigotu/replacement_for_firex_120-890b.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c48c3cc3-66ef-49aa-996e-6d8b76e94a59/38285503322.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e154d3b2-3cc0-4be6-bbc4-f94e6dfbdbd6/dnd_5e_paladin_spells_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/75d0c3a3-7965-48ff-81a3-892567ad42dc/coreldraw_for_dummies_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/74d8d678-0e3b-4c9c-a99a-f0128572c3df/26002295455.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa56e915-ce8d-4d11-a25f-3926cbeb6b92/shapes_and_color_worksheets_for_kindergarten.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/267dfa99-9ebf-4ef5-ae1d-cbfc08a5b7e2/53590785880.pdfIn PDF document text
    • https://s3.amazonaws.com/bejokazemur/mathematics_syllabus_d_zambia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fbaf973a-4b6f-40c8-9431-527834c4efea/62481681993.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ad4cccb-2da4-4466-93b9-bf384f139406/xilakabifabawimon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c342334b-e9d6-4d38-975c-c9fd4938e51f/why_does_my_directv_box_keep_losing_internet_connection.pdfIn PDF document text
    • https://s3.amazonaws.com/vedexajawo/nudadetulodanozometikel.pdfIn PDF document text
    • https://s3.amazonaws.com/bogeguva/57843648951.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2abb4d6-e7d6-4f5a-9e04-ef3d441908d6/frozen_2_script_for_school_play.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f89e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF89E 5340 bytes
SHA-256: d6c2fe20fd047d1d932ff7b2343b76b747507f4a0b35b88421deadb898231e42
font_01_sfnt_off00010ac5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AC5 11020 bytes
SHA-256: a5cf394b5f521c5f52b57a54e901130bb12f89fdcc738c343a9575b73032d9fb

Open this report in the interactive analyzer, or submit your own file for analysis.