Malicious PDF — malware analysis report

Static analysis result for SHA-256 896b47136b34bc79…

MALICIOUS

PDF

67.3 KB Created: 2020-12-26 21:26:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02
MD5: ef657223ec7d01fbc97a966b27243430 SHA-1: 15736dcdf8b36e6da4d626ea54dc58190a154a79 SHA-256: 896b47136b34bc791c068b231b79ad2ed1bca5b387f5b8496182e50023eb3a3f
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/strik?utm_term=1+pics+1+word+what+the+word+solver PDF link annotation
    • https://cdn.sqhk.co/zipodumup/jiheihd/wars_of_the_roses_battles_quiz.pdfIn PDF document text
    • https://cdn.sqhk.co/minamojazi/TRrk4zg/85012781996.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8079edc3-7678-4e6f-9f4f-94f8d045445e/pokemon_tower_defense_unblocked_games.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88dac785-7eed-4c83-a751-2d6daddfa963/415_area_code_texas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4937f311-2122-4bcc-96c4-7336cbb76346/fixaxituvifalutiguroz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a64f5a7b-5630-4d8b-be4b-c6bde7b63bf3/ffxiv_xelphatol_last_boss.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11aa1406-527f-4858-a474-1d19577e23de/pearson_geometry_textbook_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b57358b-bddf-4834-a5a6-3958a8afc1d3/indoor_shrimp_farming_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/wizedumi/zugadirosepoja.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eee47568-1601-4a6e-8e35-c95dbc4dd7c1/anime_halloween_costumes_for_couples.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9160999-3b0c-4494-89e2-bf93f57311b7/mentorbox_reviews_quora.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/be6daf33-9d34-4aa2-8acf-1c1cde5982cf/bekelo.pdfIn PDF document text
    • https://s3.amazonaws.com/nonabafat/cover_letter_for_part_time_jobs.pdfIn PDF document text
    • https://s3.amazonaws.com/resixexi/lixirafazosogo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/595a06fa-12d5-4756-b13c-31a3fc2bba3e/awesome_tanks_2_unlimited_money.pdfIn PDF document text
    • https://s3.amazonaws.com/kawotexulozax/introduction_to_logic_irving_m_copi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c97e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC97E 5272 bytes
SHA-256: 2deaaf9ebed3c259fe2af1cb48476551e820886df3714cf2432bcf541d21ceba
font_01_sfnt_off0000db79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB79 10840 bytes
SHA-256: 97427235ec03537e59237b84add4c781518721dfa25138401688926cbfec2782

Open this report in the interactive analyzer, or submit your own file for analysis.