Malicious PDF — malware analysis report

Static analysis result for SHA-256 847cb886cc55144a…

MALICIOUS

PDF

60.0 KB Created: 2020-12-22 02:29:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: dfbea7ba66271b4ec1f7bfe8b887006a SHA-1: 22134f8956881633412dc9bcf51c7b17bb962ffb SHA-256: 847cb886cc55144a617f49bb040e904645d03a7a5ffbc868389fcf7eb6ad3aae
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=clubhouse+mini+golf+arcade+bozeman+mt PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4503197/normal_5fb7ca86aaddc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392872/normal_5fd322e182fba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370777/normal_5f8f45a7150a5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ccb4efa-9041-425f-9836-6e8e8683db2d/dipopikaroj.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5242cc30a162e0c6e0a8f/t/5fc8393692e74531f3c349e2/1606957370301/dragon_city_breeding_legacy_dragon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56e2a6a9-98f2-46d1-ad94-92edf59b447b/costco_australia_ipod_touch.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/61795839-bcf7-4d38-b602-f8a7bb1e2a47/explicit_formula_for_arithmetic_sequence.pdfIn PDF document text
    • https://s3.amazonaws.com/luxelula/xizaxiwudarolimubife.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a8a9fc9-6630-4ae4-abfc-a32010d67656/5784627997.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0dd9b8ef7301f8b108504/t/5fc111fbfa04221c7145b402/1606488571740/8257881650.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe237b173fb5383b6b362d/1606296443518/77369928880.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca73658c-1272-4e6c-89ee-8d80ebba7033/gunekurefadesujanajig.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe080af3de5e49b52b2d3b/1606289419404/nhac.vui.vn_ng_ca.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0d785085bf90c0efcc6ad/t/5fc0f1ae08845d0924ac4cfd/1606480303309/historia_de_una_escalera_analisis_de_los_personajes.pdfIn PDF document text
    • https://s3.amazonaws.com/kodipopujufipig/external_ventricular_drain_management_guidelines.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fce1190f169c3718385a098/t/5fce79481d54d8271282c7e3/1607366985128/zombie_invasion_game.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000aeb6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAEB6 5528 bytes
SHA-256: 0105bb3ce74693c2e98e90f6eb88dcf9889d16faac5c68299c1e56594bc93c7a
font_01_sfnt_off0000c155.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC155 9956 bytes
SHA-256: 9ddccbb5f1b378cbb02857996cf5a56d7040d79c2e7a703d6e05648719a3db0a

Open this report in the interactive analyzer, or submit your own file for analysis.