Malicious PDF — malware analysis report

Static analysis result for SHA-256 6531c831bbaa3125…

MALICIOUS

PDF

86.0 KB Created: 2021-03-25 17:44:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 3b42ea6831c3e58d4633a1733e1887f0 SHA-1: 9ab4e4ed9978bde0f8cf505dd3b7f69fb8a2ec7c SHA-256: 6531c831bbaa31251953e501d25a4b5e195273ce4eaa81ffcaa8d61df008affc
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/wix?keyword=house+of+night+betrayed+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4409818/normal_600aebd8e3a84.pdfIn PDF document text
    • http://lady-bug.club/palabras_simples_derivadas_compuestas_y_parasintticas2kbu7.pdfIn PDF document text
    • https://cdn.sqhk.co/ruperodu/hajigh6/monkey_go_happy_451_walkthrough.pdfIn PDF document text
    • http://kneeksi.ru/libodepesusosibilekefn2e.pdfIn PDF document text
    • https://cdn.sqhk.co/rebiguta/0sdI89B/extreme_speed_car_mod_apk.pdfIn PDF document text
    • http://de-bewertung-889562.icu/macro-trends_affecting_the_future_of_the_us_healthcare_systemxlbj0.pdfIn PDF document text
    • https://cdn.sqhk.co/xulawajikigi/jjjfxyl/hoi4_close_air_support_wing_size.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446260/normal_60285708390c1.pdfIn PDF document text
    • https://cdn.sqhk.co/sozedikepasu/dSibzie/74977702302.pdfIn PDF document text
    • http://driveformclanemilwaukee.com/25713287837mvmro.pdfIn PDF document text
    • http://airned.ru/90622881758z5xsl.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/4adfe130-0ee5-45c8-9f59-1c7a907dbab9/burger_king_breakfast_prices_2020.pdfIn PDF document text
    • https://s3.amazonaws.com/verirejon/apk_mobogenie_for_android.pdfIn PDF document text
    • https://s3.amazonaws.com/fulazelof/27269875514.pdfIn PDF document text
    • https://s3.amazonaws.com/wozowuledij/48234004535.pdfIn PDF document text
    • https://s3.amazonaws.com/padadutiseni/odisha_police_physical_test.pdfIn PDF document text
    • https://s3.amazonaws.com/jojitagifuva/every_breath_you_take_flute_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/lodazojamuva/jijufonotuderolalu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/852693a3-9592-4c30-a923-6213e359c431/tl-wr841n_v11_custom_firmware.pdfIn PDF document text
    • https://s3.amazonaws.com/tonisefoteka/chocolate_film_song_malayalam.pdfIn PDF document text
    • https://s3.amazonaws.com/topipovikapari/folomozu.pdfIn PDF document text
    • https://s3.amazonaws.com/zidosozawok/nuvuxokevodu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f74397f-ded0-46e0-b7fd-66f0aef9c123/ninja_pro_system_1100_blinking_red_light.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD8E 5476 bytes
SHA-256: 7c5cc269d93a94c930cd5dbb81b1775bc4ec05ad517448621806fb91f2623e8d
font_01_sfnt_off00011025.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11025 10764 bytes
SHA-256: c2acb310126e192ca5bd18e7eee9515e1753fdba3a632a896d08786a3a396847
font_02_sfnt_off0001353e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1353E 16192 bytes
SHA-256: 1ff76b967cdf3bc4238cb8097aa9d4755c8fb5bd66c4cf01391f6e70ad1e9315

Open this report in the interactive analyzer, or submit your own file for analysis.