Malicious PDF — malware analysis report

Static analysis result for SHA-256 418dc64d4ae1c580…

MALICIOUS

PDF

75.7 KB Created: 2021-03-23 04:58:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 0422874adb812cb494012dc579b1e643 SHA-1: 542b790296fe2acef0d2ac71455c1a1e83e3c389 SHA-256: 418dc64d4ae1c580f9729b8d82ce9af1a2dfccd03b5588af2b4956cea1765493
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=maytag+neptune+washer+not+draining PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4407060/normal_5fd04bca231ce.pdfIn PDF document text
    • https://cdn.sqhk.co/jolekusij/f3hj6hh/ford_shelby_f150_super_snake_for_sale_canada.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384167/normal_5febe855275d5.pdfIn PDF document text
    • https://daniveledize.weebly.com/uploads/1/3/4/9/134900130/vapovobomokodimiwor.pdfIn PDF document text
    • https://viferoxabuged.weebly.com/uploads/1/3/4/2/134235394/38b28c558492.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4496816/normal_60086b3f7a85e.pdfIn PDF document text
    • http://wubowobipevoto.mywebcommunity.org/marxist_dialectics.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451355/normal_5fd13e956d7e6.pdfIn PDF document text
    • https://bogevojozoluki.weebly.com/uploads/1/3/4/7/134708627/beduvuwomegu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383451/normal_60232e33ee30e.pdfIn PDF document text
    • https://xofujudafovebe.weebly.com/uploads/1/3/1/4/131410434/sofetulivonafis.pdfIn PDF document text
    • http://dadevizevarek.scienceontheweb.net/any_document_to_converter_software.pdfIn PDF document text
    • https://kidamevu.weebly.com/uploads/1/3/1/4/131437276/846efc68863204d.pdfIn PDF document text
    • http://timinome.getenjoyment.net/biomaterials_for_oral_and_dental_tissue_engineering.pdfIn PDF document text
    • http://lakegefufen.scienceontheweb.net/panaburetagopifoxipago.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409798/normal_60104a2387b51.pdfIn PDF document text
    • https://cdn.sqhk.co/lebudawojafi/gHh77jv/lujuxarutisedazuvuki.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4404112/normal_6008c07414a25.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://bugenerefajujus.atwebpages.com/lukirof.pdfIn PDF document text
    • https://44bb6ee8-a0fe-4f72-890f-0f0a2fec05cf.filesusr.com/ugd/b65acf_baee11116d6649f49fb98be77dad23e3.pdf?index=trueIn PDF document text
    • https://be1b941d-c88c-475c-9260-a39c9d088d9d.filesusr.com/ugd/5c562d_289a1e606fa941e48d90185a75dd3ad5.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb32.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB32 5388 bytes
SHA-256: bd09a22868fa538f6522cd8d0e4469595ff7cb5980edfaa9792db43ef9dd5edd
font_01_sfnt_off0000fdaa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDAA 10340 bytes
SHA-256: 2d63f830f361bf9457d296ad8489fc2f90ed74d6f0a60da5f72b390195e79170

Open this report in the interactive analyzer, or submit your own file for analysis.