Malicious PDF — malware analysis report

Static analysis result for SHA-256 6410c4ac6340d907…

MALICIOUS

PDF

92.2 KB Created: 2021-04-08 06:05:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: cd23a394c361a6a1320b92d03f33b9e1 SHA-1: fb61dce8d2e060050503a3f159b1ae0f8a1b3c78 SHA-256: 6410c4ac6340d90727e56f6ec6cc9d80ded1e9dbca73c95e1fcb09d298cc9f93
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=autocad+lt+2020++offline PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4482009/normal_5fce33db96e41.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471686/normal_60431b8a3f4f6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381976/normal_5fecfb837aab7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490529/normal_5feb34b5cb8fa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403534/normal_6023c8d6939d3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490263/normal_603ffa1615e25.pdfIn PDF document text
    • http://rawuzexo.iblogger.org/whos_the_white_haired_guy_in_tokyo_ghoul.pdfIn PDF document text
    • http://zuzotolifewujex.22web.org/hanuman_chalisa_kannada_lyrics_video_download.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490739/normal_5fd5f4e284fbf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447101/normal_5fd2ed81e92aa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419412/normal_60696f07df227.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gewuwasi/marugisozodabeketapi.pdfIn PDF document text
    • https://9849c7ec-8b19-4b81-9a64-db2537ea7c40.filesusr.com/ugd/97b1c0_a990ea17150641e4ab866055105f437e.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jarawaxanivu/wijukazix.pdfIn PDF document text
    • https://s3.amazonaws.com/dowesitobuga/rifobopoleludila.pdfIn PDF document text
    • http://menenig.rf.gd/samsung_series_6_stuck_in_demo_mode.pdfIn PDF document text
    • https://s3.amazonaws.com/lorifawuvawot/canon_powershot_sx510_hs_wifi.pdfIn PDF document text
    • https://s3.amazonaws.com/rurovikejigibu/how_to_test_a_oven_temp_sensor.pdfIn PDF document text
    • https://7a69a04d-b0b3-478e-a927-895b34d3dd44.filesusr.com/ugd/159848_8050cc75a9c343a0ae675bfb782470f3.pdf?index=trueIn PDF document text
    • https://9ef77391-fdd1-48d8-ba15-364b07375333.filesusr.com/ugd/ebefdf_75c2dcf2260a47d19f1b9ae24c7f0227.pdf?index=trueIn PDF document text
    • https://a6f18165-9bfd-46c9-8f51-0ab50cd0b687.filesusr.com/ugd/265c7a_78078936aede4604ac8ddd84ab2dbcce.pdf?index=trueIn PDF document text
    • https://69df74eb-9f83-488d-97bb-abb55063df61.filesusr.com/ugd/f34323_7da0037295e74a6b9f4248183a3ba7a7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/juduk/best_budget_planning_spreadsheet.pdfIn PDF document text
    • https://s3.amazonaws.com/xapota/dash_diet_guidelines.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011d29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D29 5004 bytes
SHA-256: 96eb9a8474f5485e4f9b3f80e006dcb10f5f1f1a18aa6308c652ab7983138010
font_01_sfnt_off00012e4b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12E4B 21888 bytes
SHA-256: eb9a728def64e227e729e35dcea01087e270e6e1030091217c4de68cd643b8c3

Open this report in the interactive analyzer, or submit your own file for analysis.