Malicious PDF — malware analysis report

Static analysis result for SHA-256 5299e29304e7322b…

MALICIOUS

PDF

414.9 KB Created: 2021-03-26 08:21:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: e2bf3a29b45f8ed8f34657efb48e3da0 SHA-1: 9caad10f51fcf02232e92073173a46f16e63372c SHA-256: 5299e29304e7322b7430d1e30a489caa3819285586f3334a0f8b63cf49ae258a
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9835

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=mophie+powerstation+6000+instructions PDF link annotation
    • https://dugaposiga.weebly.com/uploads/1/3/4/8/134857723/6267532.pdfIn PDF document text
    • http://davorivugexawu.sportsontheweb.net/89390340258.pdfIn PDF document text
    • https://vixagukire.weebly.com/uploads/1/3/4/3/134364056/6088355.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370560/normal_6049cc4687893.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403260/normal_60037dd55fa0f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384325/normal_60028379f2f55.pdfIn PDF document text
    • http://jeseselanus.scienceontheweb.net/download_big_book_biologi_sma_gratis.pdfIn PDF document text
    • http://lebepufu.mypressonline.com/is_blood_of_olympus_the_last_book_in_the_series.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408713/normal_5fe2803aa98f5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://80f75f89-a1e3-4611-a0ef-7a704eb82da9.filesusr.com/ugd/0286dd_d387575ce51b4a4294b7f0ac15df6cda.pdf?index=trueIn PDF document text
    • http://bakakixutuv.myartsonline.com/fourier_analysis_books.pdfIn PDF document text
    • https://b6c9d0de-81a1-4db9-ab7d-8a95af9e63d6.filesusr.com/ugd/b28ae2_bde563c9d9574ff487d980ef8e72200b.pdf?index=trueIn PDF document text
    • https://5efcf519-4c71-4be9-a00f-e1d47ba804c5.filesusr.com/ugd/ebcc4b_1534c85ffaff4c3e8dc57d3e192e9ada.pdf?index=trueIn PDF document text
    • http://jafixomedimun.onlinewebshop.net/94362578619.pdfIn PDF document text
    • https://5548a280-a194-4776-8019-0e256783c1fa.filesusr.com/ugd/f2c1dc_93b29f6c3a524bf0a43d1e0267eafd5d.pdf?index=trueIn PDF document text
    • https://64f1e6a9-4530-4009-9f9b-67b91dd69f79.filesusr.com/ugd/76b6de_bae017a9818344178e267ce647332bc1.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0001ec6b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1EC6B 380068 bytes
SHA-256: 66340a64b5ae1d6e16844f3b7a259025675d678c2d331226dea3774b1e0de3f2
font_01_sfnt_off00062eba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x62EBA 5380 bytes
SHA-256: 9a2b81502642effebe4241e4110f4faafe5375a7743b72838d916ca85d9a4bc1
font_02_sfnt_off0006411b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6411B 15056 bytes
SHA-256: bd6d71a1a378a60acb1ede2beedd915385cb387daf7e7d931d2345aad2ac5e4f

Open this report in the interactive analyzer, or submit your own file for analysis.