Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a734a720bd3b4ba…

MALICIOUS

PDF

84.6 KB Created: 2021-04-16 11:02:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: faae1ff7242c2a426a7cfbd85c10f3da SHA-1: 132f357347440e1e5c906166dadd97b870689a9d SHA-256: 6a734a720bd3b4baff693c965020ce7c4f48479591d92f09dc00657908f6eb39
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=the+boy+in+the+striped+pajamas+netflix+canada PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4485153/normal_5fd67ef31ca50.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485005/normal_60499292373c2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4394062/normal_605b87abc42bc.pdfIn PDF document text
    • https://cdn.sqhk.co/fujalapevame/SifRgdg/nizekili.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415770/normal_6064d1907bbf8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366005/normal_606a0c3d1a9d7.pdfIn PDF document text
    • https://cdn.sqhk.co/vimexuda/9ghhh5v/pasetulugifoxikixavetitu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445116/normal_60076265a1cd1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368266/normal_605fa1f05da5d.pdfIn PDF document text
    • https://cdn.sqhk.co/jozojijejip/geRjdia/castlestorm_2_switch.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490252/normal_60125e87c5db5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462362/normal_60318799d198f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/013697a3-8fc1-458e-8211-0bb56b29dea6/who_do_i_call_to_repair_my_oven.pdfIn PDF document text
    • https://s3.amazonaws.com/toguvaju/womutidusun.pdfIn PDF document text
    • https://s3.amazonaws.com/pevuwarobuvowa/aditya_pancholi_songs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4cfc8b2-ef7a-48d8-822f-7ddd6a1c9e64/nix_digital_photo_frame_manual_x08e.pdfIn PDF document text
    • https://s3.amazonaws.com/zodawanuror/bafavejusemazupinexanuji.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48ca5cf6-4c35-4481-ba9c-2915bd6ec320/motorola_arris_surfboard_sbg6580_change_wifi_password.pdfIn PDF document text
    • https://s3.amazonaws.com/bagokiko/jifemenutuzaponix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e8509b4-230d-45f8-9628-99a35ba3ad3a/16005838533.pdfIn PDF document text
    • https://s3.amazonaws.com/fuwenoxuzasila/contemplate.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3cb0b788-7ee0-413a-bef6-7d99234391d9/ginsberg_howl_poem_analysis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9cb5ad87-c9dd-403d-a115-966f5b72e567/sharepoint_2013_workflow_not_starting_initiator_anonymous.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31571fa1-c46f-4dcd-8018-62acbe654cae/what_is_the_purpose_of_an_orientation_program.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd02.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD02 4412 bytes
SHA-256: 9a576380451ef71bdd09f1664f92c3ef206fdf7b4db9b0326db12e0e36f8e8d5
font_01_sfnt_off00010c72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C72 5732 bytes
SHA-256: 06f8f5b54cf8fe85b7bf91e5ad1e967265ceb28f380a0746ce8acd61a1ee25f0
font_02_sfnt_off00011fcf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11FCF 10712 bytes
SHA-256: a059118b4d7b5a033d1f271345238401e7c640dbfdcec51a5ff1b51e91c81102

Open this report in the interactive analyzer, or submit your own file for analysis.