Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e5d0485a6ae9dd7…

MALICIOUS

PDF

76.5 KB Created: 2021-03-21 21:15:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 7be4351e8c6492f1d3b8cc305bc29c8b SHA-1: 5ac06d49bc9e5c2118c2fbc7f17d73c8043e1db5 SHA-256: 7e5d0485a6ae9dd7e6af3c29dca3acc194ce7fd401917e9ed8808466dc8ecbed
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/wix?keyword=bonjour+tristesse+pdf+fran%25C3%25A7ais PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4450634/normal_6005f9223df9f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387709/normal_601b847e7d769.pdfIn PDF document text
    • http://tenipimutav.mywebcommunity.org/problems_of_reliability_and_validity_in_ethnographic_research.pdfIn PDF document text
    • http://korogesubelokut.mypressonline.com/bamirovikog.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458148/normal_6053bdebafcce.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4415740/normal_5fee2c5aa0fff.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467322/normal_6012457b80c57.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470699/normal_602b5c1a818e9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365636/normal_600c9a456457d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369766/normal_603baff8a2b52.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421783/normal_601cb7f63c9b4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460457/normal_603880d6412d2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410418/normal_601628ce26e17.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/patotale/jitubanotepovigunowos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/92ccd302-c14a-4074-a192-168dbbcacf65/63564138376.pdfIn PDF document text
    • https://s3.amazonaws.com/bisazabe/bourdon_tube_gauge.pdfIn PDF document text
    • https://s3.amazonaws.com/sewamos/bubizexexiv.pdfIn PDF document text
    • https://s3.amazonaws.com/fukepez/bihar_si_old_paper.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/357931ec-dc33-411b-b732-64176bb6b545/what_are_the_qualities_of_a_good_wife_material.pdfIn PDF document text
    • http://zipulosi.atwebpages.com/benchmarking_methods.pdfIn PDF document text
    • https://s3.amazonaws.com/zabevog/additional_information_form_inz.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9AD 5312 bytes
SHA-256: edf52403f3a69d667327208691b780416b591d84908587123b089e4416a81045
font_01_sfnt_off0000fbd5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBD5 11596 bytes
SHA-256: 6c217056c16b01ba04d9b997d30177612945e170a742bfad38ccfe2db8fa0f17

Open this report in the interactive analyzer, or submit your own file for analysis.