Malicious PDF — malware analysis report

Static analysis result for SHA-256 7be902603b9d5ceb…

MALICIOUS

PDF

79.8 KB Created: 2021-03-28 16:52:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: f442ab1aaffc606a72af80d36e4d592b SHA-1: 565b6bf870e275eeffd623a30c2c15344e5ef7eb SHA-256: 7be902603b9d5cebe2ff7d521107799c4ceed40bbdd46bc2c77ae64493da705c
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9961

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/strik?utm_term=2004+toyota+tundra+jbl+stereo+wiring+diagram PDF link annotation
    • http://kyrgyztours.com/template_archicad_22_brasildxf04.pdfIn PDF document text
    • http://shoop-fe.ru/loxesojuwavazakofejitu1z532.pdfIn PDF document text
    • http://ryursew.space/cae_speaking_practice_testsbr2wk.pdfIn PDF document text
    • http://storeeu.info/dubai_visa_application_form_uk5ymfv.pdfIn PDF document text
    • http://kidiwutimako.mygamesonline.org/18567165997.pdfIn PDF document text
    • http://uscovidcharts.com/robuzotidixujajokebumue7lfi.pdfIn PDF document text
    • http://numulul.mygamesonline.org/present_tenses_exercises_with_answers.pdfIn PDF document text
    • http://itash.space/my_darkest_days_perfect_meaning03ors.pdfIn PDF document text
    • http://winwites.space/tatatonu0p2vo.pdfIn PDF document text
    • http://changely.club/los_medios_de_comunicacion_empresarialna4yb.pdfIn PDF document text
    • http://organicnu.info/vowipekagowododogenopobswvg8.pdfIn PDF document text
    • http://jotitojimo.mygamesonline.org/dcs-930l_hardware_reset.pdfIn PDF document text
    • http://potuxoposutu.medianewsonline.com/face_3d_free_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pajukovuxetu/toy_defense_3_hack_android.pdfIn PDF document text
    • https://s3.amazonaws.com/pipaneku/berlitz_intermediate_spanish.pdfIn PDF document text
    • https://s3.amazonaws.com/satuja/jotuwitoratomokumo.pdfIn PDF document text
    • https://s3.amazonaws.com/xedewofuretujo/left_hand_of_darkness_chapter_7_summary.pdfIn PDF document text
    • https://s3.amazonaws.com/zabejuvijolu/national_rice_cooker_steamer_instructions.pdfIn PDF document text
    • https://s3.amazonaws.com/pazovugal/dikuxibuzodajaguleruxod.pdfIn PDF document text
    • https://s3.amazonaws.com/radubozufiwo/porukigizitavemobowosupa.pdfIn PDF document text
    • https://s3.amazonaws.com/vukujidor/kaxep.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/afe8e914-b560-42f2-a923-43f513db64d8/kifof.pdfIn PDF document text
    • https://s3.amazonaws.com/miledu/journal_prompts_for_middle_school.pdfIn PDF document text
    • https://s3.amazonaws.com/jadudusujuje/2308756688.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5d09cdd-7b9c-4811-a9d0-98dc45392bf5/berserk_manga_ending_discussion.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c386e10-f7ed-4d4a-a808-7cc0e09df2f6/kusejumolibuberemux.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f757.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF757 5820 bytes
SHA-256: 690faa77baa098eea222502f569031989758593c610455e0aff8d71c21c425fc
font_01_sfnt_off00010b30.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B30 11044 bytes
SHA-256: 0ea816586506e6a45201fd96422e823db728c3755405c8720dc16419b3836412

Open this report in the interactive analyzer, or submit your own file for analysis.