Malicious PDF — malware analysis report

Static analysis result for SHA-256 82bba2b93fc100d0…

MALICIOUS

PDF

75.4 KB Created: 2021-04-03 02:53:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 5fd3b44a5d2dd5651058b336275829d4 SHA-1: c49dc83e19e15de2dc4f0bdd9d308ec87ab21535 SHA-256: 82bba2b93fc100d09505b07d76a58f71ddbc071e1c5f2730f11e37843c844dfb
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/wix?keyword=118+element+word+search+answers PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4471688/normal_6062dc69eede1.pdfIn PDF document text
    • https://cdn.sqhk.co/pigevikuwi/gXijeFl/3d_animated_weather_widget_for_android.pdfIn PDF document text
    • http://bobujopolodusol.mygamesonline.org/39395986051.pdfIn PDF document text
    • http://nitiwopororotef.mypressonline.com/types_of_buying_behaviour.pdfIn PDF document text
    • https://cdn.sqhk.co/belexewuwif/1wbKhey/ice_cream_decoration_cake.pdfIn PDF document text
    • http://vegifeda.mypressonline.com/sefebasubulusamagide.pdfIn PDF document text
    • https://cdn.sqhk.co/vesagivara/hahifhh/taxemarodore.pdfIn PDF document text
    • https://cdn.sqhk.co/lajoroteb/BL5Tsha/85603523740.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403260/normal_60176d41537cf.pdfIn PDF document text
    • https://cdn.sqhk.co/xegunorasu/4Vibji6/skyscraper_cast_1996.pdfIn PDF document text
    • https://cdn.sqhk.co/kewawukufiju/hfdsKjh/11574235385.pdfIn PDF document text
    • https://cdn.sqhk.co/tawavumazo/gJhdjd9/zenomuvamawexi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447903/normal_6032a4f69a75c.pdfIn PDF document text
    • http://dosaxixapaxa.medianewsonline.com/aterosklerosis_dan_arteriosklerosis.pdfIn PDF document text
    • https://cdn.sqhk.co/sivojadirabe/hhhvihV/annoying_sounds_10_hours_baby_crying.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d80e544-e9e3-4369-b391-83c37ca7d2de/78332791359.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af60e625-f49c-4f1d-b2d5-6ab7f1a7ed1b/is_30_mbps_good_for_video_conferencing.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/560a2d31-93db-448f-907a-41344ec83696/33450227433.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ee7e0efe-0346-443f-a189-e2c4517d9fe0/grammaire_franaise_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/801e124d-bcdb-4617-8054-402f231ca207/jawaxozukadewejirivapesi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000f613.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF613 12104 bytes
SHA-256: 44d5acb8c8a0c7684d70bdfa698d03839de8bada8e19b0a4c73dbbfc1c0655e0
font_00_sfnt_off0000e3bd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3BD 5424 bytes
SHA-256: 234c3edf6fac5b691e44aac7de6fb9a3f1f8475dd31cc1d1d02427d455706359

Open this report in the interactive analyzer, or submit your own file for analysis.