Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ca7065f2db296da…

MALICIOUS

PDF

71.5 KB Created: 2021-03-19 17:11:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 65797525f342297fad021b5608ed3727 SHA-1: e5bbd096be17b2c7ea660a7a0298aef51a81057e SHA-256: 8ca7065f2db296da256755a7921330a3158e315c8091c397c5245f592f54ee30
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/aws?utm_term=error+e10+caja+registradora+casio+pcr-t273 PDF link annotation
    • http://waverufusufafuv.scienceontheweb.net/zenolibinudijomarorunu.pdfIn PDF document text
    • http://bazufilonunax.iblogger.org/28052930393.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sezebepit/vancomycin_dosing_guidelines_in_neonates.pdfIn PDF document text
    • http://nitovotiroxe.epizy.com/powoguwitukipurarolekag.pdfIn PDF document text
    • https://a79c6309-487e-499f-a993-0ac454a400c8.filesusr.com/ugd/747acf_8e05c271fc7a42e498d6c8222f25d5b1.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/midizaxopazeji/gapava.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48717c51-f64a-4ce4-8095-04ffb277251b/7601895506.pdfIn PDF document text
    • https://s3.amazonaws.com/sumesawoxajew/answers_to_questions_about_adversity.pdfIn PDF document text
    • http://vevisadoko.epizy.com/how_to_play_mutants_and_masterminds.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62c62ef0-d0c6-4b27-ab3e-b49a2022ec0c/kigudagufi.pdfIn PDF document text
    • https://77a80da1-97a3-4b40-ba11-54c6d232eb66.filesusr.com/ugd/39a0fd_3a2cbf74363547d9a94db0933e53ebaf.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/7da3f139-0a80-4a7d-90d9-b2c5fbd3c715/best_robot_vacuum_cleaner_consumer_report.pdfIn PDF document text
    • http://wivaxodi.onlinewebshop.net/download_adobe_acrobat_dc_reader_for_android.pdfIn PDF document text
    • http://duvewukabiwetu.epizy.com/housefull_4_film_songs_pagalworld.pdfIn PDF document text
    • https://s3.amazonaws.com/pusori/surge_arrester_types.pdfIn PDF document text
    • https://01c19f78-c7d0-441a-b56a-8672493f87de.filesusr.com/ugd/9d66c7_6beefa24a8b543a78d20e646115a7a63.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gixawetopoli/atal_bihari_vajpayee_books_free.pdfIn PDF document text
    • https://s3.amazonaws.com/bubodeliza/pokopomogudoniv.pdfIn PDF document text
    • https://9177b9cb-4c70-42bd-a9e0-27a1bf53b67b.filesusr.com/ugd/9baf76_00eaf3c16723413289bf830b71422511.pdf?index=trueIn PDF document text
    • http://lumosaneja.onlinewebshop.net/42567377605.pdfIn PDF document text
    • https://s3.amazonaws.com/vavabi/ethical_hacking_seminar_ppt_with_report.pdfIn PDF document text
    • https://2ed821ec-8078-4e74-b11b-c5cec6a88262.filesusr.com/ugd/65e777_7fc09cebb48a4cad9b98d83909ebdcc8.pdf?index=trueIn PDF document text
    • http://zanavaf.epizy.com/steam_link_android_mouse.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d80e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD80E 5844 bytes
SHA-256: 9786ad11613c581172c0fb36bdd7239a6ae29596233f7fe8f24e2b9087845076
font_01_sfnt_off0000ec1c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC1C 11120 bytes
SHA-256: 4fc83a21b0f182f5d4c214c5dcaac039ba841ed13936b59cf9e4e58ad7e668ad

Open this report in the interactive analyzer, or submit your own file for analysis.