Malicious PDF — malware analysis report

Static analysis result for SHA-256 80a28754bcae0e27…

MALICIOUS

PDF

71.0 KB Created: 2021-05-31 00:50:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-01
MD5: da9d68779fa9f65eaac4c18c53569cc9 SHA-1: 23a363b53f1d6022f913003257d6afe7e1b5eb96 SHA-256: 80a28754bcae0e27f422e503dc0ba27c841ca2a3c08c83bce0471893dd4eedeb
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=equations+transformable+into+quadratic+equations+definition PDF link annotation
    • https://static.s123-cdn-static-d.com/uploads/4464850/normal_60b401686793e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4461511/normal_600247f27be66.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4499656/normal_60615d91cd3ea.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4423427/normal_6043b5ac94f73.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4402711/normal_6006d175ed380.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4502870/normal_6035dd9e398c0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4452624/normal_5ff295e8a8fa2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369302/normal_5fe716d292fd3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463006/normal_5fd1b761c4caa.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366995/normal_5ff81a382595f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487201/normal_5fd7792fe95a4.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4415334/normal_60b3c3284df4f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451348/normal_603710bec4d1f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485322/normal_600e6156da033.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454546/normal_5fdad5659a8b7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/187d169b-ca28-4184-8719-d3ec70a85b21/bumojenamozex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5923cfc9-4f25-4ffa-8e52-b1fe64bfc376/80024421563.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b59950e-fef7-42bb-93fa-a2f59d3d35f2/xijepomeludoremepef.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4d4639a0-d836-4585-93e9-cc073c5e96b6/gagolonelugolugegidonuvib.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/545aee6e-dc15-40a2-ace6-50b085b77159/rimusok.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d49b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD49B 5392 bytes
SHA-256: 22502734c1e28e398f262583b6f7fe4a7318f547adf82740047d9f84933fc9b9
font_01_sfnt_off0000e6d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6D6 11620 bytes
SHA-256: a5efda9854ec4c3d5a31f188efb9af265fd4e7989bb5b344de13af9410ca9475

Open this report in the interactive analyzer, or submit your own file for analysis.