Malicious PDF — malware analysis report

Static analysis result for SHA-256 67c745f832d6d0a5…

MALICIOUS

PDF

259.1 KB Created: 2021-03-23 00:44:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 03d7397a0c9ac9dbfd419b242a19355f SHA-1: 8d4ddba39fe1137832ae407aa0756501b43b0e3f SHA-256: 67c745f832d6d0a5790945410ce9c57e6a15b0952dfbdac7e8ec55a1579930ea
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9887

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=western+civilization+pdf PDF link annotation
    • https://cdn.sqhk.co/bafiweba/r7jdFie/merge_magic_can_t_sell_chests.pdfIn PDF document text
    • http://mobufuwiwid.medianewsonline.com/2441439006.pdfIn PDF document text
    • https://pekiwuvigefarov.weebly.com/uploads/1/3/4/7/134766825/9453989.pdfIn PDF document text
    • https://mifabawir.weebly.com/uploads/1/3/0/7/130776047/2936305.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427284/normal_600c71119ca04.pdfIn PDF document text
    • http://jilavixit.medianewsonline.com/environmental_impact_assessment_case_study_examples_in_india.pdfIn PDF document text
    • https://gudetopop.weebly.com/uploads/1/3/0/9/130969639/1102726.pdfIn PDF document text
    • http://xuzerujagojagip.scienceontheweb.net/somewhere_over_the_rainbow_ukulele_chords_strumming_pattern.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401555/normal_602e6df4dfbf3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487191/normal_6002a0633ef54.pdfIn PDF document text
    • https://muzezibabut.weebly.com/uploads/1/3/0/7/130739211/xojuxenemumipoper.pdfIn PDF document text
    • http://maewallace.com/16276384560nrftu.pdfIn PDF document text
    • https://fotularujofo.weebly.com/uploads/1/3/0/7/130739653/9757542.pdfIn PDF document text
    • http://hightrade.club/kolidexamojodanosagojit9vzoa.pdfIn PDF document text
    • http://plusstore.pro/clasificacion_de_las_cuentas_segun_su_origen_y_naturalezak68p4.pdfIn PDF document text
    • https://cdn.sqhk.co/dopemeve/FLCheqg/mafaloxufogemefatezufo.pdfIn PDF document text
    • https://cdn.sqhk.co/rufetuzek/j5Xicii/rudowuna.pdfIn PDF document text
    • http://wiwovurezibaso.getenjoyment.net/big_data_book_2020.pdfIn PDF document text
    • https://cdn.sqhk.co/xawobovuji/jgsRjgk/wyze_app_for_pc_review.pdfIn PDF document text
    • https://cdn.sqhk.co/ragonujip/hj7Yygg/oscar_isaac_movies_life_itself.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370284/normal_5ffdccc4b7838.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382966/normal_6048be122ab7a.pdfIn PDF document text
    • http://paksorond.xyz/what_does_godspeed_mother_nature_mean99z0u.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://telosizaba.onlinewebshop.net/princeton_review_cracking_the_toefl_ibt.pdfIn PDF document text
    • http://nisetekotixob.myartsonline.com/9793674439.pdfIn PDF document text
    • http://kewevagisugimuw.onlinewebshop.net/52481412435.pdfIn PDF document text
    • http://tipipigi.atwebpages.com/kogaf.pdfIn PDF document text
    • http://xawiwevivuzox.onlinewebshop.net/cell_city_analogy_answers.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003c387.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3C387 5272 bytes
SHA-256: cb947531a4ec162e9f777fd2e737eb4ea2c75c4fb956a3a4531d2b3619de5620
font_01_sfnt_off0003d5a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D5A1 13108 bytes
SHA-256: c3c625b738e066ee4b89a314cc57c73e70ebd185d2a6933b6f524880cde4ece1

Open this report in the interactive analyzer, or submit your own file for analysis.