Malicious PDF — malware analysis report

Static analysis result for SHA-256 76937306b2885124…

MALICIOUS

PDF

66.2 KB Created: 2020-12-05 04:18:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: e38e78c4bb8412cb3635dd7a63305060 SHA-1: bdd869f1b3335bd6bdec12a0865140b5bcfcfe0d SHA-256: 76937306b2885124f165fbd7e178de5c14bddd72d93e8bc623798777d9855af2
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=pr%25C3%25B3ximos+partidos+del+real+madrid+de+f%25C3%25BAtbol PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4369932/normal_5f8d067f61dd9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static1.squarespace.com/static/5fc27eb48ef7301f8b1ae02f/t/5fc559db3c6ccf69f31129ff/1606769124152/insta_lean_pills.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0fe386b97992eb55c938e/t/5fc1f68e64571256548247e8/1606547087109/51728546731.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7034775-717e-4910-8677-3c95b8812119/harper_lee_biography_video.pdfIn PDF document text
    • https://s3.amazonaws.com/tiduro/webokorukudo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe067f3570fb44d1ca0eeb/1606289023732/supplementary_and_complementary_angles_worksheet_with_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/dozuga/insanity_workout_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/tonisefoteka/opentx_user_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a0f84d2-26e3-47d2-b95d-5ea305cc09ad/convert_1.8_kg_to_lbs_and_ounces.pdfIn PDF document text
    • https://s3.amazonaws.com/wovugi/91842281860.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc00570a3bf4b14aba44e61/t/5fc3d7616457125654b1713b/1606670177852/autoridad_de_desperdicios_solidos_carolina.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b68b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB68B 5328 bytes
SHA-256: db48066a23c5931ef80742b196972c0b66b004e1bd85972cfc86f4a378af4c6c
font_01_sfnt_off0000c85a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC85A 10732 bytes
SHA-256: 855c4d22cb7ded783464e6ac4b72d906a591455cd44e209d2e99fb7ca201c6e0
font_02_sfnt_off0000eb7f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB7F 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.