Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b3e788e1ad1e365…

MALICIOUS

PDF

95.6 KB Created: 2021-05-22 02:45:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 60289cc05188b207079531e6c7757e08 SHA-1: fcdbcda96611718cdd204775625c37d0d93b6813 SHA-256: 5b3e788e1ad1e365fb7fe4fa9b3a857dd5acaa35eb6fbfffe9ef7b2c34f1c368
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a password-protected-archive lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=driver+webcam+acer+aspire+4738z PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4384836/normal_606bd746d0314.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4461746/normal_5ffe25153b614.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450876/normal_5fee8e91e15c1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480758/normal_601ff05a813a1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369143/normal_5ff4f7d3a3384.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484814/normal_606a9a6d6c173.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4423752/normal_6062b0dba3bc1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391335/normal_605071e6bb319.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367674/normal_5ff7ce09ac712.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478923/normal_6045c8e1d015b.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/236bb378-a47b-4d40-ae8e-ebd367a609bf/the_crown_season_1_cast_prime_minister.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5676b6bb-86a6-4c90-b989-d87ae7f6f25d/how_to_install_shop_vac_filters.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1dd88a98-5258-4e31-b19a-22ff6638c609/renepin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c18b2b6-c6d2-4da7-8086-e57b5d60e73f/vibutekogerubiref.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/84d8b69f-6365-4c96-b430-ff5a9e6fe122/how_to_apply_for_food_stamps_online_in_north_carolina.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4cbd5b90-c008-440a-97af-6986326501fe/duxad.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/752f6025-2e9d-45d9-91da-8158b05554f6/what_are_godly_characteristics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/833f7c18-5e98-4785-bf19-21b9a118d70e/89125201743.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a856aafa-2242-4265-960c-87d902911ea2/golukamaxakuvufin.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00010f31.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x10F31 13384 bytes
SHA-256: d7952cf7b22cad205eea301bf39de2ba3f1e5ba569e8f625d84199c967aff37b
font_00_sfnt_off0000fb05.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB05 5916 bytes
SHA-256: 947690d2481ff17b3d520a617f1ac53d9665c8ee7112e142eede4d4764455f7d
font_02_sfnt_off00013465.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13465 10808 bytes
SHA-256: 417b1871ec0dcff99ae37002b00ded9b30511854141e36f2f1351b6d128ae85e
font_03_sfnt_off0001597a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1597A 16060 bytes
SHA-256: 4ef9506ee11a349461550e6b437e3786686b598308a87786035880d16624999d

Open this report in the interactive analyzer, or submit your own file for analysis.