Malicious PDF — malware analysis report

Static analysis result for SHA-256 85230831cfa46e1f…

MALICIOUS

PDF

85.0 KB Created: 2021-03-16 13:42:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 4343c34fa88c5a1e59672bc923462fc6 SHA-1: 56d45662e7128f7d092f4340f15a5b218129248a SHA-256: 85230831cfa46e1f090a3af258cb1b9fbc2fcf002f72f10f3130ed668f796765
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/wix?keyword=unblocked+games+mario+3 PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4465390/normal_5fe56da839bb7.pdfIn PDF document text
    • https://dapofawebowo.weebly.com/uploads/1/3/5/3/135347186/tewona.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471481/normal_600eee874498d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4458833/normal_5febe74b1e486.pdfIn PDF document text
    • https://rusipamisu.weebly.com/uploads/1/3/4/0/134017355/xunagaguki-ragid.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421767/normal_5fc67e9360a10.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419828/normal_5ff9a71c568f4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411219/normal_6031d74d1f713.pdfIn PDF document text
    • http://tixshopclub.space/law_of_property_act_1925_section_362_and_19665cma.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421036/normal_6039a3cb8dda0.pdfIn PDF document text
    • http://faceskinagainbeauty.xyz/how_to_get_iso_certification_in_india9hd8q.pdfIn PDF document text
    • https://zelowomuguzak.weebly.com/uploads/1/3/1/3/131379017/4631237.pdfIn PDF document text
    • http://arthromedro.xyz/tying_loop_knot_for_fly_fishing68gnx.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/443ff3a2-5558-4680-a716-7f2f276bcbed/learn_how_to_write_arabic_letters.pdfIn PDF document text
    • https://s3.amazonaws.com/zinudipir/creekside_outfitters_fishing_report.pdfIn PDF document text
    • https://s3.amazonaws.com/donarepemi/12981348798.pdfIn PDF document text
    • https://s3.amazonaws.com/wizedumi/85986289174.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/67a059e0-6a97-4db4-b321-487e03d9575d/what_does_black_on_maps_mean.pdfIn PDF document text
    • https://s3.amazonaws.com/zizene/avery_small_tent_card_template_5302.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d236bbc2-751e-4ffb-a245-a2a8981fde75/mabikejalenopajepid.pdfIn PDF document text
    • https://s3.amazonaws.com/vukumesoj/pesoronoruwowavu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9412cfbc-3d67-4ad3-a2dd-9fff407ccb8b/how_does_an_outboard_primer_bulb_work.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76a69db7-a418-4268-9e93-f18ed902ec6b/chniby_demo_koi_ga_shitai_light_novel.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e70.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E70 5616 bytes
SHA-256: 5115999d03e5c308f0b116c86082f94b7c4c52b44a782f60d8b248e350370734
font_01_sfnt_off00012175.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12175 11148 bytes
SHA-256: 0b27c2d1f7f5831a20c76e78df96b6453435e17951bdfd4425f68f21be6da825

Open this report in the interactive analyzer, or submit your own file for analysis.