Malicious PDF — malware analysis report

Static analysis result for SHA-256 46e9b3405022afcf…

MALICIOUS

PDF

93.9 KB Created: 2021-05-20 20:41:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 86aea01bd3804098d54a1aebd381d5a4 SHA-1: 99cd21dce04b1a2d7e71680e37aabd9ad1307c96 SHA-256: 46e9b3405022afcf07ffaa34931d79ad6398bd37c2815cf7be534c3221b6cfd3
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=contoh+factual+report+text+animal+dalam+bahasa+inggris PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4472788/normal_6001557b02355.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382627/normal_60232bbcea33a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405409/normal_600939fadfced.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485014/normal_601135fdae3b1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4452199/normal_60046862a489c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469116/normal_600b33cc40195.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e323fe2c-3764-48ae-859d-b57fc1dc7342/5352330122.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b189846b-9b7e-4ef0-8f11-eb1cc225f4ca/bujovevuwisovisijif.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9a3cbec3-afc6-4b1b-9507-0232377a2fcd/defending_jacob_episode_8_watch_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ce67a03-c831-42b1-9519-9c6ba53fd7e0/how_to_clean_a_westminster_chime_clock.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b489df0b-c805-4fe1-bc95-fa22833fc793/70536795266.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7235de12-af83-4fa6-8e58-f78e878c66d0/70422983630.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/841eb22c-f98a-4ae0-9be7-885d120a5cf1/thermodynamics_book_for_bsc_physics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bf841c81-2601-41fa-a3e8-1bb271e83c25/saneki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4aac6c01-8db9-4c2e-90ae-bcf992e2ae34/what_is_a_half_niece_or_nephew.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77917849-f41e-4fa3-ba22-72f0b3f7dda7/what_is_gothic_art_characteristics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a9d12fd-ed91-4e74-a96a-94861e5d99e9/zawajiparojawoxelusupo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012ffc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12FFC 5684 bytes
SHA-256: df8fef229971b2e4f3780df94b9ace6ba1c3b75c30e957fa644a63dc328b3995
font_01_sfnt_off0001431a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1431A 10888 bytes
SHA-256: 3cd400ab468293039443477d1d55b6fdae98bd3a582f4af7737960275d1d67e5

Open this report in the interactive analyzer, or submit your own file for analysis.