Malicious PDF — malware analysis report

Static analysis result for SHA-256 6138cdc67620caba…

MALICIOUS

PDF

76.9 KB Created: 2021-03-17 17:19:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: bb02ac50e43ddbb33382225a9b5399de SHA-1: 1adb0912703563bcdb57203871d69bd8c34754d5 SHA-256: 6138cdc67620caba04bf768aecfbcb8f9ac7a57eab0c870437757277586cf2fa
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=how+to+treat+a+dog+for+mange+at+home PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4469349/normal_5ffd6ff3ddcc5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365624/normal_5fdd05978f83a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417419/normal_5fe19008376a5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389387/normal_6029b14628932.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426422/normal_6008baea3ed4c.pdfIn PDF document text
    • http://hookup750.website/skyrim_mods_ps3_how_to_installbhap3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488574/normal_603479265e4b6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417315/normal_6049d871ba4b4.pdfIn PDF document text
    • http://1fps.ru/sejigekawilobejumoino2z.pdfIn PDF document text
    • http://good-production20.site/69259879545dx4a1.pdfIn PDF document text
    • http://lnstagaram-verifiedbadges-from.com/celebrity_quiz_game_cheatsbyp9w.pdfIn PDF document text
    • http://winfreeiphone.xyz/612015235272kq62.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476140/normal_60023ecc57fff.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417997/normal_5fd682df4c3c8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379471/normal_603270dfaa686.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366305/normal_603a2c45dca55.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453575/normal_5ff08fa5ac8e7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/978918be-e4bc-412a-8a98-95ae4503ab1c/tork_1101_timer_motor.pdfIn PDF document text
    • https://s3.amazonaws.com/xesigeze/panasonic_microwave_parts_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/wexoteluwag/indiana_jones_sheet_music_french_horn.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c36cb89-1c61-4bba-b253-58623b4196fc/7656411310.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30046820-3e07-4203-9148-347a9de0129f/fasevora.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f7ff368-4a25-49e7-8c2d-7450ada4040f/remewurisoganimoke.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/05d2406c-9195-4339-887c-158178779d14/tin_tin_chinese_food_near_me.pdfIn PDF document text
    • https://s3.amazonaws.com/xupizewuxere/plantronics_voyager_legend_pairing_with_iphone_11.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF79 5164 bytes
SHA-256: 6fd2016ec5cb7aadf1575c3d4689da3190678e7a99e427469bf301166fd72496
font_01_sfnt_off000100f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100F5 11132 bytes
SHA-256: 5a673b713fb369b34c2fad1fcf5fce34312d241e4576d6d48b7462c3997d3c9d

Open this report in the interactive analyzer, or submit your own file for analysis.