Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d3ea47337b20014…

MALICIOUS

PDF

81.8 KB Created: 2021-05-31 00:32:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 6d9a4e00580f5f6709b3148885309177 SHA-1: b1824a5b10b51d69f811c124cac8c52b5e815611 SHA-256: 6d3ea47337b20014792dd1d0f6a8e61ce5dc8de9c5468e2b1a801bdc9f8bac9d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/strik?utm_term=cara+belajar+efektif+dan+menyenangkan+untuk+siswa+smp PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4443801/normal_605a6a4456017.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384149/normal_6042ccc922043.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4456132/normal_5fe2ecfb90e6f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413121/normal_6040d8fc386c0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393779/normal_5fcdd09735a30.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485162/normal_606e3eab2f54e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378620/normal_605f60c09b170.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403689/normal_5fc6583cf076c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471958/normal_6059e9827f72c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408983/normal_5fe1bf99102db.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/9dfc1c47-c1f7-4099-93a8-9154ef257b29/rifewizitaxizasimazok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0fcbf974-544c-4d5b-b7b8-19bcd1103dc2/word_excel_powerpoint_snav_sorular.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e7301b85-e6d5-4b32-9b2d-6b50ec18e950/computer_systems_institute_skokie.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/155ce7fd-6c29-4bda-8afc-8020f5150931/xigaz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f99b98e-999e-4d3a-9a5f-90fed8647ad4/garmin_nuvi_40lm_price.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca4fd071-f9fd-478a-8e73-d224b9352565/firubekebox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/05a8f0c3-a6df-4449-93c6-8a80cfb6e34f/jemudifusujewuzaku.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/503f0a40-4342-486d-9e60-5a1b1b32878b/geometry_dash_lite_levels_1-13.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/764c4edf-d987-436d-bdbc-4e65efd57d74/gepiwuxo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4b206d9-699d-4b8c-a976-35da784d6e9f/13327857967.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f586.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF586 5632 bytes
SHA-256: 80a52c9a2e8ae136503ad1fc9545aa341aef7771a81c1c647eec409ac90b53b3
font_01_sfnt_off000108b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x108B2 10148 bytes
SHA-256: 7c5e44b4cec6c33d28aa3af92f453432eb09b1b4aeb38a1398b32135b17b08a5
font_02_sfnt_off00012b76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12B76 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.