Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a681cb1ac2fdbab…

MALICIOUS

PDF

74.0 KB Created: 2021-03-23 02:09:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 798e368f52c84a1292beb2f736f8c072 SHA-1: 5dfaa0437fb342821fa000be7c7a7d0d1aad9e11 SHA-256: 4a681cb1ac2fdbab9995fa580335c265a40ec15c28652cf532c18e9a7b9d7b4f
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=nursing+scope+and+standards+of+practice+2015 PDF link annotation
    • http://mirror-x.org/why_does_my_maytag_washer_leak_from_the_bottomfi6vz.pdfIn PDF document text
    • https://cdn.sqhk.co/toromerepowa/jhcGQNQ/wwe_raw_bleacher_report_results_grades.pdfIn PDF document text
    • https://cdn.sqhk.co/gigijuke/Hdhi3l3/94799207997.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370989/normal_6042f5b13f05e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4499319/normal_60579477aeef5.pdfIn PDF document text
    • https://cdn.sqhk.co/tipefima/arihdgh/vertigo_exercises_treatment_video.pdfIn PDF document text
    • https://cdn.sqhk.co/daxegajok/hecjdhi/top_10_newspapers_by_circulation.pdfIn PDF document text
    • https://cdn.sqhk.co/pafevola/d6QO1jg/interesting_facts_about_mexico_culture.pdfIn PDF document text
    • https://cdn.sqhk.co/puxedepobe/hfrhchd/65949084179.pdfIn PDF document text
    • http://reduslim-europa.site/system_dynamics_ogata_4th_edition_solution_manualrg95u.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382781/normal_6029aa146b0c9.pdfIn PDF document text
    • http://podjem2.club/37597482515i25xq.pdfIn PDF document text
    • https://cdn.sqhk.co/fusajovogi/wgeLtKy/steam_workshop_downloader_free.pdfIn PDF document text
    • https://cdn.sqhk.co/gebemiwisero/3jcDPkk/58949145075.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4503533/normal_60386b8ad85b4.pdfIn PDF document text
    • http://creditscorehelp.info/bibiliya_yacu_apks3xaq.pdfIn PDF document text
    • https://cdn.sqhk.co/kekotenonaxu/dijhOjg/mortal_kombat_11_characters_dlc_release_date.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba061849-88ff-4140-9a77-8751279c4fea/math_area_and_perimeter_worksheets_grade_5.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fe2d7dfe-47e0-44ff-a5b8-2847f87da613/tibetan_book_of_the_dead_padmasambhava.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fbdc9e16-df99-4ab4-a40a-5a063f2ec415/54882517217.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa324a29-c9b9-4bdb-bd1f-f772e46c81f8/74000825655.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/87963ad2-e120-4bd1-bb4c-1d65edaa9cf3/polytropic_compression_formula.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca942ce7-2773-417c-bde1-6d9a2e5a91b3/92409519935.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e272.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE272 5712 bytes
SHA-256: 48be6b2279da3419c19c980f71e6c69a58be4046c5678167183d48be85d57a46
font_01_sfnt_off0000f60c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF60C 10712 bytes
SHA-256: c9e15dccf7f543ebe9670e1823c1350ba4c3a8ad2ecfbf1c0cbdd23d2a90050a

Open this report in the interactive analyzer, or submit your own file for analysis.