Malicious PDF — malware analysis report

Static analysis result for SHA-256 57777a860dbcc637…

MALICIOUS

PDF

79.9 KB Created: 2021-03-25 21:05:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 9f15f46b23ee67435d17a4d9fafdcdbb SHA-1: 94453a2e7222e62f3fd3203faa13d4005d978227 SHA-256: 57777a860dbcc637e7a0b5ea598e4c368417e495ae15264de6ba2bd2ac1026f6
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=avery+clear+label+template+5160 PDF link annotation
    • http://tutavizukatafoz.22web.org/78842003926.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/purawuma/miwosote.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd83a17f-64c7-4c91-96ec-d5089e24e4a9/best_way_to_lose_weight_strength_training_or_cardio.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48a0ede6-95fc-45f1-94dc-9e4ea45838c4/99934830321.pdfIn PDF document text
    • https://s3.amazonaws.com/dojonuta/charity_commission_significant_incident_reporting.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/242f7527-7ed2-4204-9c0e-bc964da51790/tidogumigoworakitojexa.pdfIn PDF document text
    • https://s3.amazonaws.com/fukezavazuj/laputo.pdfIn PDF document text
    • http://gusabonatixuk.rf.gd/doxefewekoteduwomuzine.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3742af1-01d2-4c5f-a47d-ea2d5c599bca/how_much_does_genetic_testing_cost_in_australia.pdfIn PDF document text
    • https://s3.amazonaws.com/bezorito/33900619067.pdfIn PDF document text
    • https://s3.amazonaws.com/wiwamoxamo/8th_step_worksheet_aa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec431758-b2ac-48c9-8350-3e368fe4393d/xenaxobesej.pdfIn PDF document text
    • https://s3.amazonaws.com/podawakumepewez/tejirowenajik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e147b59-a2fb-4835-9dd4-406e50f8e889/sex_dice_instructions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/197ebe3e-b2bf-4c35-8517-cd856ea37208/best_settings_for_portrait_photography_nikon_d5600.pdfIn PDF document text
    • https://s3.amazonaws.com/fedure/zidumakow.pdfIn PDF document text
    • http://tupusivamiguta.rf.gd/39512315622.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b9d0693-2d2c-447f-bc17-b0732a705284/10657407831.pdfIn PDF document text
    • https://s3.amazonaws.com/bifamomove/16944583825.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e00bded-305f-4989-8c73-47ec81ac7c18/zig_ziglar_wheel_of_life_video.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/212ea928-6bcc-4ecb-bb74-0ae181707cc1/savage_worlds_deluxe_download_ita.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1C4 5664 bytes
SHA-256: 131bd90e8c5bdb286da5a0cd5c9ba0fcf734c7fd27121867ecb6302e91f5b664
font_01_sfnt_off00010507.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10507 14468 bytes
SHA-256: f9aaa3cbc057445c84b475641061b923fde094c3d6e1e0e02dd388fe05e378dc

Open this report in the interactive analyzer, or submit your own file for analysis.