Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d73fa753f42848f…

MALICIOUS

PDF

80.5 KB Created: 2021-05-15 21:30:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: c298fdc1aa0a4ca9633685e2312069bb SHA-1: 85ed35e5f4dcaeac536626e1b7c4e72b6790c7cd SHA-256: 8d73fa753f42848fb7a83611ea474b475fbf0fa1ad6c52562d992898048bb71a
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=ejercicios+de+limites+de+funciones+algebraicas PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4483388/normal_603d62b5539f4.pdfIn PDF document text
    • http://muzomabavima.medianewsonline.com/numedozagod.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489994/normal_60570eb67d4e1.pdfIn PDF document text
    • http://gopudumimipabol.mypressonline.com/greenhouse_gases_effect.pdfIn PDF document text
    • http://davupopebuwiser.sportsontheweb.net/22936982261.pdfIn PDF document text
    • http://foripekomufotir.mypressonline.com/zetifefarimiwudu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412164/normal_604aaa5adbdf6.pdfIn PDF document text
    • http://fidofawi.medianewsonline.com/box_tops_submission_form.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490129/normal_6046d2773a02a.pdfIn PDF document text
    • http://xeberul.mywebcommunity.org/basic_active_directory_interview_questions_and_answers.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418973/normal_606615a788712.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gekixadonuru/lufotakonunabozizajar.pdfIn PDF document text
    • https://s3.amazonaws.com/belapawerezuju/zelevezipebinupewofuzepux.pdfIn PDF document text
    • https://bea00909-aa88-4d38-ac88-e56db460b486.filesusr.com/ugd/923104_28d28f22df234940ae299d5386f95809.pdf?index=trueIn PDF document text
    • https://72858ab8-d36f-4bc2-b208-e5ec56e76d01.filesusr.com/ugd/3a4e0e_64cb66c3955d4326a6a9d5e5c3eb8b21.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vixuwogetiv/dimesixepuvufot.pdfIn PDF document text
    • https://9cf93ecd-64ee-4ad6-afcc-f350577a7522.filesusr.com/ugd/c4dbd3_e5cb66879818465aa8ad67f6950082f5.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/mexesazaxasa/ratetorimezafu.pdfIn PDF document text
    • https://711920be-b761-4f0e-a604-762b26663b16.filesusr.com/ugd/ffcbea_b943efc5aa9c44eb8f1b45a09929721e.pdf?index=trueIn PDF document text
    • https://1ac5d900-0c69-4f12-8b1d-4e209472b8d2.filesusr.com/ugd/828753_29d3e5d5e7284432953739bb0d518bb8.pdf?index=trueIn PDF document text
    • http://tebuwawezizafes.onlinewebshop.net/vibezawapidetemediwozemuj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f7ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7CE 5512 bytes
SHA-256: 718dc42e8f4af5f167a9aa3d5a4fd6a63d80d13a9a6b13fde4bb6bf6510fb3f8
font_01_sfnt_off00010a79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A79 12564 bytes
SHA-256: 0a5dad5e7256fd0b4e9c0a669c1df756915917a26fe6d5c85c73463f6536f471

Open this report in the interactive analyzer, or submit your own file for analysis.