Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d29a23a4c6254e9…

MALICIOUS

PDF

73.2 KB Created: 2021-02-19 06:15:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: fd6ae983fbd77db4c643a159b2a8f202 SHA-1: 3e11bc73af92329bad084b5284ab59b11d1bf31b SHA-256: 5d29a23a4c6254e9983a02fc2f527f8eb4f89cc3cbb1e2956ee9b09ecdbec509
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=how+to+cite+a+tweet+ap+style PDF link annotation
    • http://ruseseru.iblogger.org/larelorifavun.pdfIn PDF document text
    • https://wibugosavuzatug.weebly.com/uploads/1/3/4/3/134349607/5782515.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4375088/normal_6004acf1587fa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4466173/normal_6003ca33dd552.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501029/normal_5fd678c93c23f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372967/normal_6005ea161cada.pdfIn PDF document text
    • https://zijolafazul.weebly.com/uploads/1/3/0/8/130873795/mesodajadukabelafir.pdfIn PDF document text
    • https://xeresitemuja.weebly.com/uploads/1/3/5/3/135311884/2866b77316.pdfIn PDF document text
    • https://riwusivi.weebly.com/uploads/1/3/4/9/134900433/7476905.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413469/normal_6021cfad71849.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417983/normal_5fc5af7c378f9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://bosirizowu.rf.gd/cdsco_guidelines_for_ethics_committee.pdfIn PDF document text
    • http://livukuxuperum.epizy.com/82512558969.pdfIn PDF document text
    • https://s3.amazonaws.com/xukirizugukugi/74923941057.pdfIn PDF document text
    • https://s3.amazonaws.com/buxoparadazegu/fusionner_avec_adobe_acrobat_reader.pdfIn PDF document text
    • http://gipumupanaw.rf.gd/message_in_a_bottle_book_free.pdfIn PDF document text
    • http://vufagozujidivu.epizy.com/35296212565.pdfIn PDF document text
    • https://s3.amazonaws.com/zunewidimem/78863103629.pdfIn PDF document text
    • https://s3.amazonaws.com/tolivajupeku/zemebarinejix.pdfIn PDF document text
    • http://zotapem.rf.gd/98361630917.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df3b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF3B 4984 bytes
SHA-256: 5123a6872b533cf9e780c85494471bdc7f8de44b55a254e20b6906077dbf6a75
font_01_sfnt_off0000f05c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF05C 11604 bytes
SHA-256: 3e5904bd8a35b9ce9e7fc0504b7c8b2f98e5182e3ac0fd1ee9d2faf7d65d6620

Open this report in the interactive analyzer, or submit your own file for analysis.