Malicious PDF — malware analysis report

Static analysis result for SHA-256 79b05c356a35a9f1…

MALICIOUS

PDF

70.8 KB Created: 2020-12-09 21:02:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 689f396e01b9845679e39812370a7ad5 SHA-1: 53c09c010ee4888d6c199bd7f16116e1b7a02a09 SHA-256: 79b05c356a35a9f1796cf711ef667a773787f75a71cc3584071ca56e52dc8905
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=iroquois+middle+school+dress+code PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2973dc74-f8cf-49fe-a3c6-07fb43b5eae8/dijuzejutibubudopalep.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6cc8f9d43d906ac099289/t/5fcc055a24c49707d30b6602/1607206236063/sculpt_it_clay_directions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1035b370-0bf5-4eae-a422-02d6237b1063/3_doors_down_6_feet_from_the_edge.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc100ee92c50b1a1e781c95/t/5fc1f92ffa04221c71659036/1606547760441/60387920585.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1bad7132-e704-4bcc-bc57-0d765ba2bea9/tigusakamusanimo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4eadda4-0f93-4b30-8ee3-0c4e4aa749d9/game_sloth_online_games.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc11101d26ff1194f749d44/t/5fc4ea133c02f22b9da6e508/1606740500948/14185887286.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2fb60c30a162e0c601609/t/5fc3bc9e61e25426e1a9cef2/1606663327032/eastchester_high_school_calendar.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6bcd4dc4-71bb-4017-8228-a0af53da69d0/installer_google_chrome_sur_freebox_revolution.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d58467bf-d0ce-4ced-a1b0-f7dc11fff1c3/8165929672.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b952404f-fb1c-4a5e-b46e-02f38df1d998/vududabupixanedu.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc29d8640f1034a5cb3e639/t/5fcbd45ca3bc3d1915398a3b/1607193693418/lifeafter_game_pc_version.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da51.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDA51 5032 bytes
SHA-256: 1e9e8217a8e65537d5b2d1078065652b73fcb5fddbfaa77501223384c1ee89da
font_01_sfnt_off0000eb3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB3D 10252 bytes
SHA-256: 6e484e6b18390ab3ea0e8d2f6a557c2e30eb0976a48ad9b65473fb44195fe7cd

Open this report in the interactive analyzer, or submit your own file for analysis.