Malicious PDF — malware analysis report

Static analysis result for SHA-256 47730d7cf0a0f049…

MALICIOUS

PDF

81.0 KB Created: 2021-05-24 09:45:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 24dcae543cc53189dcc838af68442c75 SHA-1: d5754e2e96985f7ffa27f2297eb2ca88217f7c6f SHA-256: 47730d7cf0a0f0499b1fb98c75c1e4a594929904c806fd7e927269c4fa48b67f
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=propiedades+f%25C3%25ADsicas+y+qu%25C3%25ADmica+del+mercurio PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4465924/normal_5ffa5efd85ed6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468563/normal_5fdb9eb29527f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374957/normal_6031bb54792dd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446026/normal_5feb126ed09dd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460970/normal_606d3b171594c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/panokojol/xizodinasifarov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/57afdeef-bf54-45ac-93f2-f7ba4c48379c/wederomowiwi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e1b5516-075b-4cf6-bbca-f1f79684a3b7/context_clues_worksheets_multiple_choice_2nd_grade.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d135964a-65d0-455d-9732-0641e6c8024a/39831942235.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c912ee4e-0480-494b-aec4-022863d80301/sig_sauer_p320_vs_glock_19_en_espaol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa917dcf-c32c-4c19-8181-a54e354cd53d/graco_relay_jogging_stroller_reviews.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64c12605-8aba-450c-9490-88d792ccbad0/perogowapized.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/93deabb3-d153-4db3-b312-1d4af9a86218/xezimuzori.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a7b570b-fa02-4f0c-b1f7-e4994b3a9e41/60248454216.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9b079c1-b6a5-441c-ba34-81e8c4e24cd2/78268500105.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e2e31f9-237a-43c6-b1d9-6d50266ad288/patafediwixi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2989484e-5d02-4468-99ff-57cab35d39af/66416072275.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af7c68e3-8453-4286-8398-f1d01df145f1/the_b_word_in_arabic.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6fa37e4-54ce-47ec-9fdd-ef76083b4e9d/blessed_be_your_name_chords_c.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d2e1825-57a6-44ae-9d5d-ae3bfd3dbbd1/56727384393.pdfIn PDF document text
    • https://s3.amazonaws.com/norozovijalu/aerosmith_complete_discography.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11b1f90e-24d0-4069-afe2-566b0fc4e397/75356120165.pdfIn PDF document text
    • https://s3.amazonaws.com/fenatagazise/cellnex_telecom_annual_report.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7CF 5584 bytes
SHA-256: f1036b3e5253761e41f3d9e447a5b57d047e5a3d779d304b9ff35a3df093796e
font_01_sfnt_off00010ac9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AC9 12652 bytes
SHA-256: 0b1d4937bc850ef1b56351093bd3fd19561061c147cc39568d9b02c7e92091a9

Open this report in the interactive analyzer, or submit your own file for analysis.