Malicious PDF — malware analysis report

Static analysis result for SHA-256 7881b6e77d1fe22e…

MALICIOUS

PDF

77.2 KB Created: 2021-03-05 13:54:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: eb10c0566755a382cf6a14d35bef7c7a SHA-1: 4a007ad77f5db7ad1a48e988d8865d005565f685 SHA-256: 7881b6e77d1fe22e255dbbb2d30491af788da742ff86d2ea7aa395000cf6315e
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=nordictrack+c1800i+weight+limit PDF link annotation
    • https://cdn.sqhk.co/jesarijufe/e3zbEhc/gevijoxorusow.pdfIn PDF document text
    • https://cdn.sqhk.co/xedogigiloli/bT7jhA7/12954688261.pdfIn PDF document text
    • http://bezigex.iblogger.org/xaxewukubalafaxufituli.pdfIn PDF document text
    • http://nemipenekav.iblogger.org/75881712552.pdfIn PDF document text
    • https://cdn.sqhk.co/kewawukufiju/dchgicu/chicken_invaders_5_multiplayer_crash_fix.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/serogajugomiji/xuxilelitezafubotaladew.pdfIn PDF document text
    • https://s3.amazonaws.com/bulolimepol/auxiliary_verbs_worksheet_for_grade_1.pdfIn PDF document text
    • http://vamuxusonepuf.rf.gd/3017015134.pdfIn PDF document text
    • http://fugolosabi.epizy.com/lexowojuvigedaferusatob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/beca1e31-c4c4-4c25-bcce-d96786ea6aec/how_to_become_a_appliance_technician.pdfIn PDF document text
    • https://s3.amazonaws.com/jaxesabi/tamil_life_advice_whatsapp_status.pdfIn PDF document text
    • http://potubavaziripek.epizy.com/49302717082.pdfIn PDF document text
    • http://nafaloputazesoj.rf.gd/medigabugolafetekevex.pdfIn PDF document text
    • https://s3.amazonaws.com/gavapozalilup/attic_ladder_installation_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/629ef44e-9ecd-4795-8ac7-217baa9a9531/61839190916.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/600964bd-ee18-4c5b-af3f-7c53eddbf8da/74849273255.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/657f11f5-3390-43c4-b9c0-f5a308690bc2/los_hijos_de_sanchez_resumen.pdfIn PDF document text
    • http://jojofolarimema.epizy.com/toviponujimuvubivaz.pdfIn PDF document text
    • https://s3.amazonaws.com/fikuvine/moxekezobomufon.pdfIn PDF document text
    • http://pidezesu.rf.gd/what_does_the_disney_character_filter_look_like_on_tiktok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97990889-6b48-4808-8110-5cca5ee0c834/oshenwatch_canada_reviews.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e157.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE157 5372 bytes
SHA-256: 971cc77081f9caf42c00a43d1a7a4b459b22ca22bcc76805e6297e840706f25b
font_01_sfnt_off0000f3b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3B9 10932 bytes
SHA-256: a8b556ba881733443c18d12ac8b76f6626706220a6b902cc14872d98d7888cb8
font_02_sfnt_off0001192a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1192A 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.