Malicious PDF — malware analysis report

Static analysis result for SHA-256 44be9b003068fcfc…

MALICIOUS

PDF

73.3 KB Created: 2021-06-09 05:28:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 4e34143c9f96ee09df539670ea615dd4 SHA-1: aee04249d1a3eccd017ac8b82f50d88e2426a8d0 SHA-256: 44be9b003068fcfcea4a28cded82c59ad570337d3c522e336bf81aefa2f6673c
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nomylo.ru/pbw?utm_term=how+to+find+out+the+serial+number+of+your+laptop PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4496381/normal_60079a71f0f18.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414500/normal_60b7f2b385c22.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4458132/normal_6008d8f66bc16.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488336/normal_6011891fec7a6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471985/normal_605ff32a94e77.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387814/normal_604c999a9fcf1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407060/normal_5fdbc001a062d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4466364/normal_60316747d5ff9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4492586/normal_6029c37db4b66.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4466376/normal_6064054b3e206.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449604/normal_6030edfc01baa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414498/normal_5fdfa9e5b8275.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480161/normal_5fc71b925a639.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://kibumezi.pbworks.com/w/file/fetch/144453255/how_to_get_geometry_dash_2.2_for_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3eaa7fb6-f35e-4842-8a9d-74551ed2ff75/cuales_son_los_medios_de_comunicacion_del_mundo_empresarial.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1d3c4751-837c-4543-a2e9-e6f28acf725f/66544346770.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97fb2fcc-cebc-43d1-9473-7dd86d6e8b32/stihl_ms170_chain_file_size.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d300fa5-03a7-4f4a-ad96-71b5ad6defab/boworepizegebigoputa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5abee61-3a6b-4d0b-978f-3bc45181d627/what_brand_attachments_fit_husqvarna_128ld.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec79c6d7-6f39-4a73-b370-701f4208994e/how_to_survive_police_interrogation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d78cddda-d571-463f-a8c8-1b1ed8064109/flow_chart_of_a_simple_effluent_treatment_plant.pdfIn PDF document text
    • http://lebunurivugu.pbworks.com/w/file/fetch/144644367/smallpdf_pro_full_apk.pdfIn PDF document text
    • http://furalagaposu.pbworks.com/f/junghans_milano_mega_solar_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d516.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD516 5456 bytes
SHA-256: b349399a1ec7640915991333843da11beff2691981f5e60641f46f6fac4a4bac
font_01_sfnt_off0000e77f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE77F 9920 bytes
SHA-256: 2ebdd1c61562820e3facbfdc11a0a159e851a87576f3ec70a8f1b728de5b18af
font_02_sfnt_off0001095b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1095B 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.