Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a012e17cfb4d1b2…

MALICIOUS

PDF

365.5 KB Created: 2021-03-20 06:55:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: a2b03eca87b48345a696fb17a698a99a SHA-1: 0915d3c78f8244534721a8160cd5357745fc0dd0 SHA-256: 8a012e17cfb4d1b2f0cce0c57f854a991869245418d3f15b8ca4c7c1d3ee67f2
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=libro+de+metodologia+dela+investigacion+sexta+edicion PDF link annotation
    • https://cdn.sqhk.co/daladovum/RZaiiPc/lagu_cheap_thrills_remix_dj.pdfIn PDF document text
    • http://rufisurerupu.iblogger.org/mujudipujo.pdfIn PDF document text
    • https://cdn.sqhk.co/vipujitebiki/hQsgjic/48076738546.pdfIn PDF document text
    • https://cdn.sqhk.co/fogizotufijo/gjxNlR2/jetekuvaferafapiwukiwox.pdfIn PDF document text
    • https://cdn.sqhk.co/kufejagefep/hghjDgi/metal_shooting_action_games_download.pdfIn PDF document text
    • http://rakedotizem.22web.org/jixigi.pdfIn PDF document text
    • http://xibevajisigidig.22web.org/anestesia_peridural.pdfIn PDF document text
    • http://pamefiluj.22web.org/kosakata_bahasa_arab_sehari_hari_dan_artinya.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f77fc48-1c5b-41fc-93a0-3a19d4b1e0aa/relion_blood_pressure_monitor_hem-741crel_4g.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8d703ae-77b4-43a1-b038-127c3f8750b2/neil_degrasse_tyson_ice_age_character.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33184209-110a-45a8-8b4a-64c4df18f5fa/jorefajepomizimefoxenafu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d77d9dae-f7ef-4a02-b3fb-2eea730e3551/python_learning_online_quora.pdfIn PDF document text
    • http://nigiragesowujow.epizy.com/hip_hop_dance_music_remix_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53daf0a0-fcf4-44ad-b112-e956d11afc22/21338360859.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/61224677-4627-4366-927a-d87b36368e31/mejobi.pdfIn PDF document text
    • https://s3.amazonaws.com/falevi/domefomuva.pdfIn PDF document text
    • https://s3.amazonaws.com/xajowu/credit_risk_management_textbook.pdfIn PDF document text
    • http://pupitudaxomibi.epizy.com/j_j_benitez_caballo_de_troya_3.pdfIn PDF document text
    • http://gamukezaf.rf.gd/38123088552.pdfIn PDF document text
    • http://bafimilatape.epizy.com/dodobobi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b3def238-8014-4cb0-aa28-8708aac611da/fomegazukava.pdfIn PDF document text
    • http://rekalira.rf.gd/10063770318.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005657c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5657C 5468 bytes
SHA-256: 2e3035e02ff79fd8363a4dc516d78b8a709f8c99a2725a94c7ad90ae36fb9990
font_01_sfnt_off00057809.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x57809 14464 bytes
SHA-256: 991df541b094b79c38e027576844df4b12289a27aa15d20f01935b28a98a408d

Open this report in the interactive analyzer, or submit your own file for analysis.