Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a69f4d88f7b210f…

MALICIOUS

PDF

215.2 KB Created: 2021-03-18 01:51:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 46b9988abade4b7671fcfc98d09ee819 SHA-1: 1b4694cc4ad5a695b30e8c49091f409f515d62e0 SHA-256: 8a69f4d88f7b210f609fa35899cbd9383fb178cbd8ee4d2e4344a74cfa396db2
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9938

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=the+cold+war+abroad+study+guide+answers PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4383321/normal_603cb2b962159.pdfIn PDF document text
    • https://pupadidaf.weebly.com/uploads/1/3/0/8/130873798/pigoniwabopuridis.pdfIn PDF document text
    • https://cdn.sqhk.co/tivinarafuvu/AgeDhdW/car_eats_car_apocalypse_racing_mod_apk_download.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465270/normal_6005eabecf62a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485301/normal_6046677186ad5.pdfIn PDF document text
    • https://tutobino.weebly.com/uploads/1/3/2/6/132695576/6775307.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450727/normal_6045003263bed.pdfIn PDF document text
    • https://cdn.sqhk.co/pebekaja/lhdiajj/monstera_plant_leaf_turning_yellow.pdfIn PDF document text
    • https://cdn.sqhk.co/juvebuzizej/haMnDq8/guardian_university_guide_2018_journalism.pdfIn PDF document text
    • https://telogedibosujo.weebly.com/uploads/1/3/1/4/131438044/minuriwowube.pdfIn PDF document text
    • https://cdn.sqhk.co/zasokolof/GSo7hh8/30629821024.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444371/normal_60328eed1b34d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372980/normal_5fc60446d9fae.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nakevoja/lagu_kuasamu_bunga_citra_lestari.pdfIn PDF document text
    • https://s3.amazonaws.com/gixawetopoli/7220856513.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30e355a3-c63e-4224-ac12-bc3295ce42b5/arabic_writing_exercises_for_beginners.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba98b929-88ce-4fc2-ad57-beec3c2ed26a/51849143148.pdfIn PDF document text
    • https://s3.amazonaws.com/difigomisosak/walter_riso_frases_enamorate_de_ti.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd43ced0-3039-4b85-92c4-887c8d2291d4/emergency_survival_kit_list.pdfIn PDF document text
    • https://s3.amazonaws.com/vonusirukete/romuno.pdfIn PDF document text
    • https://s3.amazonaws.com/firudegix/have_we_lost_anyone_in_space.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00031517.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31517 5484 bytes
SHA-256: 9ea85de1ba6c56048b6b571ecfc7122cd67f5da2a890f2630b6a06b5098d3e9b
font_01_sfnt_off000327c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x327C9 11264 bytes
SHA-256: 67b555366f3b81d83501f5453f8e97ba9558ea0131bd99bb831c9fb9154f0298

Open this report in the interactive analyzer, or submit your own file for analysis.