Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a62872215c289fa…

MALICIOUS

PDF

94.4 KB Created: 2021-06-02 04:53:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: f22674a3f621249b0984b8256e695f7f SHA-1: 0b81139f40ea4b646dcd3b204e8cbafc30aa8bde SHA-256: 8a62872215c289fa2a57cc18051fef516b52d6a17127c8df6039257cf41bc26d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/123?utm_term=bdo+witch+pvp+guide+pre+awakening PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4444098/normal_606366e5ebed7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368978/normal_603e95e3dede9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481411/normal_6040ac1464cc5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459481/normal_602342f2b754b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482415/normal_5fd182e13190a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4491159/normal_5fe3e40aa8cf5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/231602ee-8ca9-48c9-8653-cde44579cd42/43530694017.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b683daa6-269a-42b3-a2b3-ece102f90dd0/76143196536.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/03d915e4-2561-47bf-9b4a-1deb6662066b/puwajufezo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76ea17d7-e8ef-4f90-a059-8573479772b3/26927505015.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b1cb08b-c9c7-41b6-b94c-1d7ae56af86f/pikuxezotubizod.pdfIn PDF document text
    • http://vifogajo.pbworks.com/w/file/fetch/144487236/how_to_apply_punjab_police_vacancy.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/846b00c9-df16-4551-8f0f-a81b3de424d4/lefudexalotekoteduwakep.pdfIn PDF document text
    • http://luwapoveduvi.pbworks.com/f/gobotagalarug.pdfIn PDF document text
    • http://luwivaj.pbworks.com/f/kung_fu_panda_3_full_movie_in_hindi_download_300_mb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/65177dbf-769c-47e6-849e-3723cbeccc0c/dd_sheep_race.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fcd9db68-ebb5-41f7-88d0-0811cdc33633/82674665557.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/13100a5f-5fa6-441a-9736-2755f667f004/what_is_pronoun_write_its_types.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dabf2b18-99ed-4080-9e1d-0b523ee243e1/lenilonapekuje.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011bda.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11BDA 5392 bytes
SHA-256: f8580a9894c5105a62c120d8381b792f456fbbbfe97438fc1dac06ba9d90753e
font_01_sfnt_off00012e49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12E49 11328 bytes
SHA-256: 54c835c0f8dee2604291c29738df3182590b94eb32b399455788e48021ab5d42
font_02_sfnt_off000154db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x154DB 17120 bytes
SHA-256: 4b41ab1d27c846a6c7af25254e0763ac9adc52b4bcf20cb8a5a8073ba7136a4a

Open this report in the interactive analyzer, or submit your own file for analysis.