Malicious PDF — malware analysis report

Static analysis result for SHA-256 8caf5a3b888a2f2a…

MALICIOUS

PDF

74.7 KB Created: 2021-05-30 21:07:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: d6ae5b3dd6632f62a531f67675c87c74 SHA-1: e4ece81bad95d7e2588b659472160f67cc73139f SHA-256: 8caf5a3b888a2f2a4d9172bb90241698cb061f8193bc7bf9efddb171f916403d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=2018+calendar+template+excel+philippines PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4368751/normal_5ff3862a25ec1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4482027/normal_6055bc01e3d49.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403119/normal_5fc7214e4c8c6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465694/normal_5fdaaf3e7b3ce.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4373788/normal_5ffcdc34e7870.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443354/normal_5fe9f0e55b46c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4483388/normal_5fc895764c50a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0249d39d-67a8-4150-8fbc-0122c95f51d2/how_to_get_free_chips_zynga_poker.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/52104d7f-e21a-4d8b-a256-f0d1a9f86cd4/how_do_social_media_support_relationship_marketing_for_business.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6925ceaa-c4cb-4eae-83ab-eb4a72a2d242/law_books_background_images.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7bc53c20-0520-4ca5-a090-6864a3d61c4c/compare_and_contrast_manual_accounting_system_and_computerized_accounting_system.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55244042-f5ab-4fbd-b568-c8acd2364d7a/85705313190.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/edf7c315-46bf-464a-b019-824ec08baa09/counting_stars_piano_sheet_music_easy.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/866a086e-d213-43c0-b9e4-2fbe63c2d103/gexojuxowerexozin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b65313c8-d759-479f-adb7-41645e9bd2b8/child_support_if_you_have_50_50_custody_in_texas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2dd93a92-02f0-47a8-9f93-10382fc07fb2/ocean_fishing_reel_for_sale.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e786.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE786 5804 bytes
SHA-256: 48539cc06a8b780de4a86a9f632921e8d3bd8ebb1b98fe45eb099c7c57d30cf6
font_01_sfnt_off0000fb24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB24 10196 bytes
SHA-256: bbf9b034585aa7176787124d36604f9f247f3ed22f0d65dafd5766114788ba0b

Open this report in the interactive analyzer, or submit your own file for analysis.