Malicious PDF — malware analysis report

Static analysis result for SHA-256 72abaa8eb3343726…

MALICIOUS

PDF

80.0 KB Created: 2021-03-24 04:32:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 33d52e43d9596fbb3726df3698cdfc44 SHA-1: 596057f4c70685e6cd5f32a837257d355ec3ab57 SHA-256: 72abaa8eb3343726a1d9363e3c7fea166f5e33fe4eaee603843644f9d490ae93
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9964

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=diagrama+bimanual+con+therbligs+pdf PDF link annotation
    • https://cdn.sqhk.co/daxerarugak/vgfgd40/joltzdude139_borderlands_3_moze_build.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474176/normal_5fc763fb63741.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4492575/normal_604d09f95166e.pdfIn PDF document text
    • https://cdn.sqhk.co/fakameratexe/icictmQ/mystic_forest_live_wallpaper.pdfIn PDF document text
    • https://cdn.sqhk.co/logubaxe/bibrheR/xurekirateruxuwekiwu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501962/normal_600fa02daf202.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422622/normal_6010e417a36f2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386365/normal_6019ca6195b03.pdfIn PDF document text
    • https://cdn.sqhk.co/nuvuvidova/jf3o4gB/napovuludur.pdfIn PDF document text
    • https://cdn.sqhk.co/satidaruxami/hi0ieir/kubra_ez_pay_richmond_va.pdfIn PDF document text
    • https://cdn.sqhk.co/zifeduwa/bOhi88T/fagamibipumona.pdfIn PDF document text
    • https://cdn.sqhk.co/semiwewedazi/PfwGiby/donuts_drift_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/naziwixolagu/zjazLji/zagitosawadusogo.pdfIn PDF document text
    • https://cdn.sqhk.co/zejizoguzut/NMGhege/catch_ultra_beasts_ultra_sun.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4495994/normal_5ffabb7a5d587.pdfIn PDF document text
    • https://cdn.sqhk.co/golizojuw/ifjbY5Q/meme_generator_apk_cracked.pdfIn PDF document text
    • https://cdn.sqhk.co/jofutagi/CjgTjix/download_dungeon_madness_2_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/norifasil/jgLjdje/sports_car_sound_ringtone_mp3_download.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489028/normal_5ff0745b49390.pdfIn PDF document text
    • https://cdn.sqhk.co/bikakigiben/gehcjdM/need_for_speed_rivals_ps4_multiplayer.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446765/normal_600bc52d86fe0.pdfIn PDF document text
    • https://cdn.sqhk.co/luwiwaduna/1hjb80j/the_flash_cw_channel_directv.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb8de3c3-341d-4e6a-9abb-be1bbf43af81/which_is_better_atari_flashback_8_or_9.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4ae9d75-6eb0-4786-a0a7-6c19eb095799/navien_240a_price_canada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dcdef569-95d8-461c-8bac-3f97fcf265d9/wordpress_download_images_from_media_library.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eaa59560-3cff-4f82-a6fb-0ab716d47d15/waferoguvuxavovojimugiru.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e44ab41c-292a-4c78-87b4-8c806b346a99/narrative_of_the_life_of_frederick_douglass_guided_reading_questions.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6FD 5708 bytes
SHA-256: a2a8f8fb45482158a65e70475d65c0d1c996b897e591a0ede86357ebe5d9a0c0
font_01_sfnt_off00010a37.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A37 11760 bytes
SHA-256: 384ba8c580d7e1570a5be5e7a968cc9d00184cb1537aaf8c89725f247e953f05

Open this report in the interactive analyzer, or submit your own file for analysis.