Malicious PDF — malware analysis report

Static analysis result for SHA-256 515a5c09148504d4…

MALICIOUS

PDF

72.8 KB Created: 2021-03-26 07:44:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: f99f6b84df47e9be2d028bbdea47a415 SHA-1: 1b98f8de5cf3673c5ada50bba7d266d4a68cd19f SHA-256: 515a5c09148504d41ff04ae7dcaad718b602821de0d7b55377aa47183312d5fc
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/123?utm_term=coordinating+conjunction+worksheet+for+grade+6 PDF link annotation
    • https://cdn.sqhk.co/zezinojox/O7jjSid/worship_songs_mix_mp3_download_2018.pdfIn PDF document text
    • http://about-igsupport.com/23156017296m72q.pdfIn PDF document text
    • http://uaregroup.com/jokepuvewewexuveja61tqx.pdfIn PDF document text
    • http://tameeniraq.com/unwind_neal_shusterman_analysisgykco.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380854/normal_5fd7bfe629a8c.pdfIn PDF document text
    • https://cdn.sqhk.co/pawekenu/AA3jegi/concrete_poem_template.pdfIn PDF document text
    • https://cdn.sqhk.co/bubiwalifeda/5BVqhcJ/9_months_pregnant_belly_measurements.pdfIn PDF document text
    • http://digitaltoolsfor.xyz/entrepreneurial_mindset_definitionsy8qw.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417140/normal_6051e26b7eb9f.pdfIn PDF document text
    • https://cdn.sqhk.co/dexasubu/tigjjie/bisebikesurupi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4423429/normal_602f402c8baaf.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dewazewokib/75760132082.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f19f080-551c-41ab-bb9b-44db899e7a72/survival_of_the_fittest_mobb_deep_download.pdfIn PDF document text
    • https://s3.amazonaws.com/warapagefasovi/tom_hopkins_how_to_master_the_art_of_selling.pdfIn PDF document text
    • https://s3.amazonaws.com/rijaliwiguvex/why_is_my_moon_sign_different_in_vedic_astrology.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3ed78bd6-1a4a-4819-82d8-0c277ca7058d/22293989624.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9890f258-803c-4e9b-a313-8641b26fa2de/mikecrack_diamantito_3_cancion.pdfIn PDF document text
    • https://s3.amazonaws.com/sumesawoxajew/87635392657.pdfIn PDF document text
    • https://s3.amazonaws.com/bokofapig/united_airlines_information_line.pdfIn PDF document text
    • https://s3.amazonaws.com/wudibirewuduto/56925261700.pdfIn PDF document text
    • https://s3.amazonaws.com/zisulamisozoto/totewededexigitizijubadoj.pdfIn PDF document text
    • https://s3.amazonaws.com/sajatofubote/wafagusaxotusekujunodo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDFED 5540 bytes
SHA-256: 541692494cc305d94a952d0fcf8dee2ccf3b4569d552ea220d24e33d56a9c505
font_01_sfnt_off0000f2dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2DD 10296 bytes
SHA-256: 1ce45b827b226df944a8aa19dfc593a15510c69f4760fefcc6de561c52d23cfa

Open this report in the interactive analyzer, or submit your own file for analysis.