Malicious PDF — malware analysis report

Static analysis result for SHA-256 58a95e6b9f32a498…

MALICIOUS

PDF

100.1 KB Created: 2021-06-06 21:19:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 545e6cd8c386873bc6029d85a168a9f4 SHA-1: 492b07be96e31159ff7ae97ec1e8bd5918640bac SHA-256: 58a95e6b9f32a49811eb9e058e3e1aa96cb72d7ef6e7e9bcdb215cef2b5f876b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/pbw?utm_term=hiragana+dakuon+practice+sheets PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4374699/normal_5fdac5e179ece.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472213/normal_60177c9bd31db.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471988/normal_5fc57632b957c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408355/normal_603c3e8e9a525.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389085/normal_60692d550d472.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471273/normal_600f4373ee32a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477167/normal_602e166265122.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366665/normal_603c26f202efa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366653/normal_603d7e22767d7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4483361/normal_5fd989cfc1c88.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459466/normal_6014d508c96cc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370528/normal_603be5809d021.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447885/normal_6016c8a1c6d88.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4427795/normal_6005828006261.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419846/normal_60450319ef5cf.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4460708/normal_5fe3a0ce2233b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481069/normal_603ff53dc42d3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421627/normal_601f1b37f34d6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390643/normal_604777979a669.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403406/normal_604fc6cbb4cd3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://uploads.strikinglycdn.com/files/70e2b3d7-4f37-428e-a3b1-353ce26fd7b4/how_to_become_a_vet_assistant_in_canada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dffe5ec0-6a51-4abe-bac2-02c5a4d04838/xepazofunukapul.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00016c91.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x16C91 16244 bytes
SHA-256: ca7f2d38d644cd97ce86afcb348ccf5d01ebf98274145d6f7e9fd86babcf921d
font_00_sfnt_off000104b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104B7 9040 bytes
SHA-256: a2db426abd28d9de6ef40dcbde918c20f03d62c4fe1b1de56d617d0e827058d1
font_01_sfnt_off0001233e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1233E 5328 bytes
SHA-256: 4afb13152fb2d95aa7bbab79b275c06f0e3a446c7adf785fa0b22f6a4f87a9ab
font_02_sfnt_off00013549.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13549 5760 bytes
SHA-256: de46439eda5cfc7f924519dd708e35369f62af7410977144c8cbd33b452c3fb2
font_03_sfnt_off000143bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x143BC 12548 bytes
SHA-256: 62ec9b1dda60be1bcbf1269b4779178eb545b1c8838879218313249c4174ff8d

Open this report in the interactive analyzer, or submit your own file for analysis.