Malicious PDF — malware analysis report

Static analysis result for SHA-256 7df892c76b8e3a6f…

MALICIOUS

PDF

201.3 KB Created: 2021-05-29 18:03:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 8209287228c9bb100fcc47565ffa8c29 SHA-1: 55492473ad69e6df9d20e5385af373a74321bcf5 SHA-256: 7df892c76b8e3a6f6950e5f52330f4cfc2a53ab9bf27d6e3ebd1f41249d7dd1e
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses an urgency-based lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5754

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/strik?utm_term=diabolik+lovers+game+english+online PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4369643/normal_604f00247492b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366028/normal_5fd132b84376a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489240/normal_60183bd4a3ae4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445118/normal_6009f78889851.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485810/normal_60095a65d43f4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414500/normal_600ae1b76fbe5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370985/normal_5feafa60c82bb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417037/normal_5fcaa8795e4d0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374542/normal_5fcdc252998db.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4389606/normal_6006c5351ac79.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420029/normal_6066d73633d1f.pdfIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a806db59-ec22-42d7-868a-79719fe19edb/how_to_change_speed_on_segway_ninebot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5cc3603-0de2-48e9-ba57-124716baefea/84330246607.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/28cc09c4-8b21-4167-a188-5f625709ad42/bexofigimelubizazut.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aff695fd-f63e-46f1-9d1d-453da86de9e0/42953171283.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/65d05791-946c-4cca-a025-94fc7ca179fd/which_english_book_is_best_for_competitive_exams.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d2c6e7fa-29b8-4419-ba01-21b57f84f78d/what_is_visual_aids_in_teaching.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eda97696-6e04-46d0-b664-28825dc37447/nepepeg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73c44be2-bdda-42ba-9115-69bc0554a6f9/verbos_regulares_e_irregulares_en_ingles_para_nios_de_primaria.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20917f7e-d6f0-4f8e-9406-61f3361c9808/what_can_you_watch_news_of_the_world_on.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2456578-8838-40b6-9dcb-f37540dedc37/bluetooth_share_folder_windows_10_to_android.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off0002ae1a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2AE1A 1788 bytes
SHA-256: 3cda33e86397f8defed18490b5f25de88393a219c9c5bc6c765397dcf1a5fda0
font_00_sfnt_off00026e7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26E7D 13772 bytes
SHA-256: de9de3d84dbdfc2dd197af306a2bcd16abc32fd53a4f58e9e18868ab737f58e4
font_01_sfnt_off00029bfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x29BFD 5364 bytes
SHA-256: db9a0b8407a1409455a2376fbb01bcb16bc40c9f80fc88cc89daf6c391de5391
font_03_sfnt_off0002b742.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B742 1952 bytes
SHA-256: b1a480d809a993db91b267b1fd97cc44c980bef417d39a97914768b3d59378c4
font_04_sfnt_off0002c0ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C0EE 1964 bytes
SHA-256: a1790f282d3844ca3286807c5f05c15de1d1247b34c91ca45da6f06341c3dacf
font_05_sfnt_off0002c9fb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C9FB 13352 bytes
SHA-256: ed1ee8799dfdf8069b636c98f57c8da075440253f9c5ff4a2d13bba64238a75e
font_06_sfnt_off0002f716.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F716 18372 bytes
SHA-256: 1fc8bf3ad674f1e67a5d33b34999452096f638f7c54c9c07c94c9f0fb12b7897

Open this report in the interactive analyzer, or submit your own file for analysis.