Malicious PDF — malware analysis report

Static analysis result for SHA-256 7740d4b17f26c120…

MALICIOUS

PDF

72.3 KB Created: 2021-03-25 04:36:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 69afc18bf69e7d55deda794eca235b1b SHA-1: b3493d0824ab052dd951d48b3efb2fa5edd32ac5 SHA-256: 7740d4b17f26c120f63d321d963124908d1e0992891ea745ac01f39f6b80e960
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/123?utm_term=2002+chevy+trailblazer+service+manual+pdf PDF link annotation
    • http://afracheat6.xyz/axxess_aswc-1_installdsu8q.pdfIn PDF document text
    • http://cafe-cok.ru/charity_event_poster_templatei2qz9.pdfIn PDF document text
    • http://bamimutekinawaz.22web.org/organisational_behaviour_case_studies_with_answers.pdfIn PDF document text
    • http://mananeje.66ghz.com/clawback_letter_template.pdfIn PDF document text
    • http://7evenrp.ru/ong_orality_and_literacyuxl7t.pdfIn PDF document text
    • http://mekuwomusaxonod.22web.org/verbal_reasoning_test_examples_and_answers.pdfIn PDF document text
    • http://nopiwez.22web.org/archie_comic_books_free_download.pdfIn PDF document text
    • http://rumurel.mywebcommunity.org/a_counterblaste_to_tobacco.pdfIn PDF document text
    • http://balifruit.com/gedarn19j1.pdfIn PDF document text
    • https://cdn.sqhk.co/vuzowadijavu/BQBjjoE/wulodivewokumusujizovobom.pdfIn PDF document text
    • http://praktika-ingenieur.com/cleaning_solution_for_braava_m6nu85r.pdfIn PDF document text
    • https://cdn.sqhk.co/tovasodoj/QieijnO/73290076682.pdfIn PDF document text
    • https://cdn.sqhk.co/fizuborugas/jhaheia/i_m_not_a_helicopter_mom_meme.pdfIn PDF document text
    • http://wejesigozolireb.getenjoyment.net/29329421765.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/galinikagopit/texas_comptroller_of_public_accounts_annual_report.pdfIn PDF document text
    • https://s3.amazonaws.com/zijivevip/how_long_to_cook_a_turkey_in_a_char_broil_greaseless_fryer.pdfIn PDF document text
    • https://s3.amazonaws.com/paropabaru/free_math_questions_and_answers_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c8e1db2b-b812-4978-b181-b3fdf54b6c01/pajosedokudev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/042e7196-b4ea-49bd-9dae-536e67695006/fufegepamotibejeso.pdfIn PDF document text
    • https://s3.amazonaws.com/xufujofaleki/tuwuxixexekuribarokeberu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47b78662-bb84-4dea-b05a-3e9f4364ab72/87198505532.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b382f222-387f-4cd3-8d87-ff24e7593d87/89864424829.pdfIn PDF document text
    • http://fuvamawijivef.atwebpages.com/tp_link_powerline_adapter_password_reset.pdfIn PDF document text
    • http://tutufot.rf.gd/11924651983.pdfIn PDF document text
    • https://s3.amazonaws.com/xefezesebusu/what_does_my_sun_moon_and_rising_mean.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db69.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB69 5924 bytes
SHA-256: b4226a7d2f83f766454dc880088a02c4abd569a3c2e6c08021ea3420c780d1c8
font_01_sfnt_off0000ef75.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF75 10528 bytes
SHA-256: c17c37b5b578ffd721a4fbed663792b7f8222d4f2e02fc33973aaa1b2a55d645

Open this report in the interactive analyzer, or submit your own file for analysis.