Malicious PDF — malware analysis report

Static analysis result for SHA-256 74d4dad2a9870f96…

MALICIOUS

PDF

171.4 KB Created: 2021-03-20 23:55:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 9bf81d80b03243171862ff4d0a4827af SHA-1: 56b70698cb14f3acc69858ea17081351a70dcf13 SHA-256: 74d4dad2a9870f964a16cbed8fc14ffdfff93c878eef4132ac016cd37f80dc8a
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=wisconsin+age+of+consent+rules PDF link annotation
    • http://fastgetme.online/798509795590zr1c.pdfIn PDF document text
    • http://mixed-rootwork.com/64430966823lm20i.pdfIn PDF document text
    • http://oneitstore.pro/koxalesutonopy1q2y.pdfIn PDF document text
    • http://samettemiz.xyz/53672259325epno.pdfIn PDF document text
    • http://www19216801.site/esv_bible_translation_reviews355ga.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://964beff5-d24f-450a-94e2-fa7e9faef44a.filesusr.com/ugd/61158f_5b43189ef61945489a35d616d9467f6f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a5a3bf3-ea48-4cd8-88de-478a3917d9cb/vusubumel.pdfIn PDF document text
    • https://s3.amazonaws.com/gopifu/82991880738.pdfIn PDF document text
    • https://s3.amazonaws.com/genukopapovixo/xafujakotagojixep.pdfIn PDF document text
    • https://944bcc21-9f45-42c2-9889-8cf837fa5d1c.filesusr.com/ugd/50f869_2a00f1888ce044d69b4387651fd8ef99.pdf?index=trueIn PDF document text
    • https://b81e1767-bb0d-4562-9f98-cfef66859bb1.filesusr.com/ugd/b48b60_1bcd72c48d7a47c19250e13871e0ead7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vukumesoj/46347535865.pdfIn PDF document text
    • https://s3.amazonaws.com/xuxifuzituwu/arabic_audio_music_free.pdfIn PDF document text
    • https://1f49b3f1-4b09-4f89-88df-03804352fc9a.filesusr.com/ugd/a51aec_ee2896ea5b0a4ef6815197f4bc37caae.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fosagoba/lemekuxibefejoloza.pdfIn PDF document text
    • https://s3.amazonaws.com/jazofi/12867743733.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e41aa22-3298-41c0-bae7-0d91a31ea0d2/how_to_release_my_psoas.pdfIn PDF document text
    • https://f2d828cf-06d9-46ea-85af-d88b0bc20d44.filesusr.com/ugd/501a20_df6252716c3b4e55819a7ef808f6f8e6.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/genijusemu/fakuz.pdfIn PDF document text
    • https://s3.amazonaws.com/vuraradaso/89436901872.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/26e07dff-14fb-43ef-9ea4-e5c1be2e7644/worulowejukipisazutok.pdfIn PDF document text
    • https://12f7643e-9106-4823-89c2-0bdaecd1bc22.filesusr.com/ugd/1f6d71_0477130ab86a4b7090ca4f3d775b8e75.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/baxunaf/tujonewut.pdfIn PDF document text
    • https://3a7b682b-4b85-4b21-836a-a34929c8735b.filesusr.com/ugd/0cd3a8_18b055ba4de142b6a43c9370328e4439.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00024fbb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24FBB 5060 bytes
SHA-256: eac42bfc24e147e1b0573ce6206b0923bd52c14dda0624d977b23b91b4b50637
font_01_sfnt_off00026116.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26116 12260 bytes
SHA-256: fb18b247aafcefa0f016125c90580882d928989bdcb6b454d6f8591d6a6958e7
font_02_sfnt_off00028aea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28AEA 16060 bytes
SHA-256: 4ef9506ee11a349461550e6b437e3786686b598308a87786035880d16624999d

Open this report in the interactive analyzer, or submit your own file for analysis.