Malicious PDF — malware analysis report

Static analysis result for SHA-256 43ae0a2b6275a526…

MALICIOUS

PDF

112.8 KB Created: 2021-03-22 13:06:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 75aa4988d477a4a22fbd0da3496470b1 SHA-1: 8993ef1e21f928eab8b4cf737ed479a3d080da35 SHA-256: 43ae0a2b6275a526f8b6afd1850b58fcf31ceee43792cd0f2d3ac41ff5c1d577
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=cabbage+family+plants PDF link annotation
    • https://cdn.sqhk.co/pigujoxexate/5jdCw8h/cnc_router_table_kit.pdfIn PDF document text
    • https://cdn.sqhk.co/modesinilofe/vjddOQ9/marble_mission_game_online.pdfIn PDF document text
    • https://cdn.sqhk.co/jokawefezo/iitNZ3V/8_ball_pool_hack_2020_dinheiro_infinito.pdfIn PDF document text
    • https://cdn.sqhk.co/pazaxefuma/CjanNjj/buloredobujepidixijop.pdfIn PDF document text
    • https://cdn.sqhk.co/nukunudakiju/gUOgeie/tejowalo.pdfIn PDF document text
    • https://cdn.sqhk.co/simixejazir/idifjaw/crossroads_mall_santa_hours.pdfIn PDF document text
    • https://cdn.sqhk.co/wutijiwatar/iathbhh/wesun.pdfIn PDF document text
    • https://cdn.sqhk.co/fedelubu/jgeDjhG/jopaxipopunalejugavuxovux.pdfIn PDF document text
    • https://cdn.sqhk.co/zekafomaze/idhagcj/44066416006.pdfIn PDF document text
    • https://cdn.sqhk.co/zetanitanedo/gejj9bs/93308098296.pdfIn PDF document text
    • https://cdn.sqhk.co/xezexasag/jfmihvU/zafado.pdfIn PDF document text
    • https://cdn.sqhk.co/motulobugaji/chezjaL/warren_buffett_house_omaha_nebraska.pdfIn PDF document text
    • https://cdn.sqhk.co/wixexozesila/jifjj7P/kimekamevekexanejire.pdfIn PDF document text
    • https://cdn.sqhk.co/werutojij/MT6ONie/ronuxosotuzopexefos.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f4522048-9074-4765-98fd-df8a40541ca7/what_is_the_average_salary_of_a_supply_chain_manager.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5e2acc9-2bdc-4031-9f67-579fed93e913/65219296585.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/665d0ec4-387d-4c20-8d0e-36cd12f98398/bosokawezojexejokatex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/21e9f4a8-2d82-4f95-9d37-fb8f88b45bb6/59862219651.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/095ecd02-06a2-4694-a749-feb57e4ae6a4/sword_of_summer_twilight_epic_7.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2aab7a55-a7ff-47c0-b39f-221a3d7139ec/races_of_destiny_3.5_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e0808af-a764-47a4-ad57-b7937fdb739a/96893340541.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2517de4-7e93-48ee-a53e-22b8a0e9e2bd/what_is_the_electron_geometry_for_h2o_molecule.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001787a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1787A 5272 bytes
SHA-256: ce27e0d52d6b0b86b53175bca5cc208c15098b08dd476c5ede7cb8f5d5041305
font_01_sfnt_off00018a65.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18A65 12856 bytes
SHA-256: 9e003aa09dc990811a28f5641887503268313207a991767df508dfd05cf02f06

Open this report in the interactive analyzer, or submit your own file for analysis.