Malicious PDF — malware analysis report

Static analysis result for SHA-256 52187e0431823a4c…

MALICIOUS

PDF

76.3 KB Created: 2021-05-29 08:06:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: dc8306ace8372045455d7e4e206e64e2 SHA-1: 92183635dd2843b51d92e6e22e65f6b20460f968 SHA-256: 52187e0431823a4cef4b3393924eb9ccd117df4f3ecb203531d1f1aadd894558
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/123?utm_term=kadambari+full+movie++free PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4452173/normal_5ff6a9efbecb6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408352/normal_603e3d6c79ca5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4427780/normal_5fc5e626cd97a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366961/normal_5fe2c3cce0157.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377717/normal_5fe92d3475244.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387716/normal_606cdd84877f4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446016/normal_60382d8b8fd80.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376127/normal_601d212824f72.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417426/normal_6002d0b177587.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1eb87c4a-7bcb-4aaf-a3bc-4ca183984c79/amplificadores_de_audio_para_casa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80969b11-eab9-4e9f-9318-fd03ada7569a/how_do_you_play_pairs_card_game_spit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2dbcd44-f990-43db-befd-dda4b15b0ca5/singer_futura_xl-550_price_in_india.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d61fc46-0334-49cd-9594-cfd71e6c9aa5/the_midwifes_apprentice_chapter_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c84fa38-5a85-421e-8dc1-2bd1d667b137/bruce_lee_ki_film_dragon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b95c6d07-4622-442c-99af-62260efa08b2/durolibalaxuverotadivevo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d0f0ccf6-6f5d-4c68-9a64-cfbfcc788724/dowuxebiraxemalinup.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/14910b19-e032-450f-a383-69e964747a69/teoria_del_color_de_isaac_newton_wikipedia.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eee6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEE6 5044 bytes
SHA-256: 1ae077dbf5d202667a4a269943e55569c058f2e8fc89903b3cc6beafaa5d4075
font_01_sfnt_off00010001.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10001 10692 bytes
SHA-256: 93785f6b67a4ba0ef86460da8c5f03ed845ad77daab2585d0644cac912a892cb

Open this report in the interactive analyzer, or submit your own file for analysis.