Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c66ef3fc1702117…

MALICIOUS

PDF

84.1 KB Created: 2021-05-22 17:22:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: a74c859d6273084b69229664964c0002 SHA-1: 2c6ff90a4dad66c992521e49a4548f72d8b15e32 SHA-256: 8c66ef3fc1702117dca52891a4cfa63c76c8f999362f9ecbb4acae366f598a55
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=when+was+the+browning+a5+made PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4448992/normal_606a75ba8046a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366055/normal_600a4fe11d606.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426422/normal_605f478450ff7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c130789b-b706-46db-bdf5-aa0ebb30167a/30251990505.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/72b631a4-c465-4bb5-947e-083b2ec26a2a/69371399183.pdfIn PDF document text
    • https://s3.amazonaws.com/lejivugeleguwod/java_update_171_64_bit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e729a710-6863-4a03-afd3-4fea8b945e5c/bmw_motorrad_navigator_vi_car_mount.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8984b852-b547-4e82-9759-f031f1307370/69911200820.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ebc54dc-0bf6-42bb-a249-003193420dbb/gawoli.pdfIn PDF document text
    • https://s3.amazonaws.com/falufusu/ap_tet_english_vocabulary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c757d15d-5935-4bf4-ad38-8dacef86d165/chick_fil_a_spicy_grilled_chicken_salad_nutrition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4bdc0f5f-e8cc-497a-9d72-74dfd6610400/37625421534.pdfIn PDF document text
    • https://s3.amazonaws.com/dobesogum/academic_poster_template_powerpoint_a2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1d9b446b-b9e6-4b44-a607-e89ad4b2e4ab/4396300101.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c991f6d-19d7-4783-82fe-e8884a45fd03/letogujamekawixojaxotive.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8348aae9-7848-4703-8125-cad81f95fa47/lefago.pdfIn PDF document text
    • https://s3.amazonaws.com/dukajevo/ant_design_form_tutorial.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36024bd0-3aa6-4c0c-bf99-5af7727daf4c/how_to_take_apart_a_shredder.pdfIn PDF document text
    • https://s3.amazonaws.com/bidemewufa/bangla_calendar_video.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e577979e-d6d7-44dd-943b-c512123831a7/tekonsha_primus_iq_proportional_brake_controller_review.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0FD 5576 bytes
SHA-256: 77003365202dc45701e317c31c05299cc050ffc6d2733c33a71ed9326c35dc3e
font_01_sfnt_off000103db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103DB 12900 bytes
SHA-256: 942b8b3988cd1bfb2965c2da5ac5376262fb3e9845c0130325f00157ba961bd7
font_02_sfnt_off00012dab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DAB 16060 bytes
SHA-256: b10e7a0583bf6b216a5471aeed10f14210f1dda3adb60ac5169fcb38ba12e60c

Open this report in the interactive analyzer, or submit your own file for analysis.