Malicious PDF — malware analysis report

Static analysis result for SHA-256 689017d006ca392a…

MALICIOUS

PDF

91.2 KB Created: 2021-05-18 13:51:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 8802469f633132e4c3051ee90da22fa6 SHA-1: e997bf94e2cf804263d076c334a926c55922949c SHA-256: 689017d006ca392ab76a62f10f93b17168f3fc30d97fc922fc9d1ccda2f76c5e
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=download+film+dear+nathan+full+movie+google+drive PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4421966/normal_60530277417f6.pdfIn PDF document text
    • http://pomurofame.iblogger.org/lean_to_carport_plans.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374978/normal_5fe36120e8f7b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426075/normal_5fe0c710184ac.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ee87f1a-ebe5-4cbd-a6c1-d62930be577a/16692574181.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c83fc16a-9578-4e92-ab86-c55b1b6a6c9e/instalacion_de_gas_domiciliario_bolivia.pdfIn PDF document text
    • https://s3.amazonaws.com/pegozegi/hollywood_animated_movies_2016.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a4d8d0b-190c-459e-8d26-43d2a59bef9e/data_warehouse_interview_questions_for_informatica.pdfIn PDF document text
    • http://rekefapurepe.epizy.com/short_stories_for_grade_2.pdfIn PDF document text
    • https://s3.amazonaws.com/panalipolifod/basekibuzepi.pdfIn PDF document text
    • http://nelibodelil.rf.gd/guxinepeniligawezewok.pdfIn PDF document text
    • https://s3.amazonaws.com/dufekifaral/lexus_rx_350_rear_cargo_area.pdfIn PDF document text
    • https://s3.amazonaws.com/wolawatin/photoshop_banner_shape.pdfIn PDF document text
    • https://s3.amazonaws.com/wobuzisibal/cheat_engine_android_no_root_2018.pdfIn PDF document text
    • http://kipetitumi.rf.gd/prelude_in_d_minor_bwv_999.pdfIn PDF document text
    • https://s3.amazonaws.com/votawawo/whatsapp_status_audio_songs_in_tamil.pdfIn PDF document text
    • https://s3.amazonaws.com/jotizifime/98206135999.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ac70998-4027-4634-bf27-ef774311506b/white_fang_skateboard_uk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9ed899e-02ba-48b6-a8f4-f5e7a9650cd8/cortisone_shot_for_cystic_acne_before_and_after.pdfIn PDF document text
    • http://jusowegakero.epizy.com/mosevu.pdfIn PDF document text
    • https://s3.amazonaws.com/sinamozagemoger/tarodoropilabu.pdfIn PDF document text
    • https://s3.amazonaws.com/datarofapakil/omega_juicers_customer_service_phone_number.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010336.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10336 5296 bytes
SHA-256: 797b0a0dd7405d324c45ceea9e4450f0879e26c83e7af2a6b5e0eb231ac2b165
font_01_sfnt_off0001152a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1152A 3120 bytes
SHA-256: 2a059f7ec4bfbf4239ef5bb317dd8705d33ac5ebf085a5031e1b41be3d2b48c0
font_02_sfnt_off00012204.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12204 11736 bytes
SHA-256: 4bfd3f44d653bc026124803b59e9f60f1963a30088cafa1c9a2f56ecbca27411
font_03_sfnt_off00014a2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14A2C 16308 bytes
SHA-256: d1f015a84b6729bda498b7383d47f462b397ad4f5f9a76ab3b285b19d547a41f

Open this report in the interactive analyzer, or submit your own file for analysis.