Malicious PDF — malware analysis report

Static analysis result for SHA-256 5930aeb0de72fcb4…

MALICIOUS

PDF

155.5 KB Created: 2020-12-24 14:01:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: a99044067a989d92a96bf0335efa893a SHA-1: d2f6b56fd9f10a9d55fc91ede7e27d9590f887c9 SHA-256: 5930aeb0de72fcb49d7d5143bf654475df2b85a55c62d32b593ddb1e37d21f12
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/aws?utm_term=bible+kjv+1611 PDF link annotation
    • https://jufaxexave.weebly.com/uploads/1/3/0/7/130775513/ronufebe-fazabewoxifuli-mitosi-sobonatifa.pdfIn PDF document text
    • https://jepalojut.weebly.com/uploads/1/3/4/8/134863082/zirutudixodaxodene.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462697/normal_5fafd73cc76a9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365613/normal_5fbf655d0c629.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370744/normal_5fb273eeb2d60.pdfIn PDF document text
    • https://sitegevom.weebly.com/uploads/1/3/4/6/134664280/9591294.pdfIn PDF document text
    • https://cdn.sqhk.co/bujavenizake/ihcajiG/flappy_idiot_bird.pdfIn PDF document text
    • https://cdn.sqhk.co/linerutinew/vcjhhgg/domovo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/f71c422e-c5e6-4abf-9ca9-7bc36d7b08ba/72840847925.pdfIn PDF document text
    • https://s3.amazonaws.com/ganubifirigevi/bed_sheets_and_comforter_set_queen.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f4091b1-873e-42cd-a4e6-23934dd367c6/fl_commando_d_day_mod_apk_android_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1aeefd7-5dba-497e-a43f-c01efbc44520/salegapojutimajugin.pdfIn PDF document text
    • https://s3.amazonaws.com/wukara/kedejilezomivomepuf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1f37c1e-2d08-46a1-a60c-182ae5d86bff/2181272383.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e67a98e7-d2df-4c4e-9ac4-72716d0de7c5/mega_man_costume_toddler.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000215d5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x215D5 4788 bytes
SHA-256: 80cfe6bc9e3ba700b0946cad3b600f4f85be5b64b6c0e4787408e887d300ec80
font_01_sfnt_off00022643.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22643 1964 bytes
SHA-256: 7a94dfa282ce0347053782d8b955d7618f774adb37c3bd5f03dce838a494a32e
font_02_sfnt_off00022f50.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22F50 15292 bytes
SHA-256: 9a782f304cc3b0fe16ece94796225ee14d2c446f52fc5eab9b3616c619e43892

Open this report in the interactive analyzer, or submit your own file for analysis.