Malicious PDF — malware analysis report

Static analysis result for SHA-256 815de592175bcf25…

MALICIOUS

PDF

76.9 KB Created: 2021-05-29 17:42:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: be8d843aa18e96ecb0e21d4ee226c6bb SHA-1: 74df0fc3da952c3677e7df3dd12aa243ffcf26ca SHA-256: 815de592175bcf258358579ce9517b789fe1c9e3397ebf4e38f48d978413268a
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=tema+animasi+power+point+2010 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4375353/normal_6040e36a77c65.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415782/normal_60246a1d6e547.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383699/normal_6029b593686fc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381098/normal_603a4f2d575b7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366309/normal_5ffc2c60b50d6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481520/normal_5fe4630aee487.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490539/normal_604169c68c3fc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415291/normal_6069db1e18a1f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454162/normal_602e81a48daa0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392862/normal_5fd37ced3346a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375352/normal_5fe9e2477b276.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480728/normal_60570e79e3634.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365612/normal_6023a661f2ca2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376101/normal_5fdb77bb2aab6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403556/normal_5fdff1b13ab98.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445745/normal_5fc5c24f7be83.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4463277/normal_5ff933a5ced9e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4463263/normal_5ff1db0874416.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba561f69-4914-4f4c-b2f6-afdbd27e50d8/ninereweluside.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f49deef1-658d-40ba-a796-68a02a2d1586/gubifuzorinuputano.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d970dfe7-925e-4896-b808-bd36d42b8753/bupevumip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c891d32-a62c-4070-87a8-e2e66d6d8aaa/nuvexaxanaviwisosetizu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e283197-d228-4c1e-bb6a-3d58988bac23/the_trial_franz_kafka_important_quotes.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED1A 5300 bytes
SHA-256: 7172d9d440d534b51698956dd818eed80d1b5392a7ae7b447582060409d74aa3
font_01_sfnt_off0000ff16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF16 11316 bytes
SHA-256: 8c96ab88cb267f44f7f98716b5834d9f8ee0d029eb6f1d30bda397fbea570f16

Open this report in the interactive analyzer, or submit your own file for analysis.