Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e6e577741f7c67c…

MALICIOUS

PDF

80.1 KB Created: 2021-03-06 06:57:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: fd827919323929db98c7154fe8f5d8b3 SHA-1: 5a29e684736d81041ca3314be0bda818d40db17d SHA-256: 8e6e577741f7c67ce5d7e9c9073974470ba7dc4770e6f0e35c224bedca2cad5d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/123?utm_term=no+logo+naomi+klein+summary PDF link annotation
    • http://pofaduxiruk.getenjoyment.net/lapesebuzilalem.pdfIn PDF document text
    • https://cdn.sqhk.co/rorajakura/fUhgggt/gold_rush_3d_mod_apk_happymod.pdfIn PDF document text
    • http://kamikofonem.mygamesonline.org/25670024340.pdfIn PDF document text
    • https://cdn.sqhk.co/kerosumumato/C8gdgiC/pocket_option_review.pdfIn PDF document text
    • https://cdn.sqhk.co/givikofuf/c7jjAie/the_walking_dead_season_one_apk_data_rexdl.pdfIn PDF document text
    • https://cdn.sqhk.co/zifeduwa/XGgiKhb/path_of_war_expanded_errata.pdfIn PDF document text
    • http://zodelem.mygamesonline.org/dirirewedifog.pdfIn PDF document text
    • https://cdn.sqhk.co/jibezilesu/jYjdY2A/song_hits_2020_tagalog.pdfIn PDF document text
    • https://cdn.sqhk.co/xeloxilava/hcibehi/dexekenux.pdfIn PDF document text
    • https://cdn.sqhk.co/zapiseniw/Fddghu0/monster_truck_cake_kit.pdfIn PDF document text
    • https://cdn.sqhk.co/xitilesuxiw/XghNidg/download_game_space_racing_2_mod_apk.pdfIn PDF document text
    • http://duxinivodozular.mywebcommunity.org/citizen_eco_drive_calibre_8700_battery_replacement.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb69dc68-e80d-4add-b203-3d7bbdd98779/bufebototunetukapizevini.pdfIn PDF document text
    • https://s3.amazonaws.com/gosete/phrasal_verbs_esl_video.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df95f1e8-4489-4b6b-9a18-a4b4afe0d30b/will_ps5_have_4k_60fps.pdfIn PDF document text
    • https://s3.amazonaws.com/nimuwet/veperitigusilaseveg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e9b4c16-af9a-420b-97fd-a7cdf601e578/tipirekebulibupafo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/46bd32f6-c92c-46f0-9024-681b67403520/4606688983.pdfIn PDF document text
    • https://s3.amazonaws.com/luropiw/66723516464.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d446117-3b73-4410-8c17-9ddc3284f0e5/66534602432.pdfIn PDF document text
    • https://s3.amazonaws.com/radubozufiwo/vizif.pdfIn PDF document text
    • https://s3.amazonaws.com/zarusegibitumet/bollywood_movie_2019_free.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fcba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCBA 5140 bytes
SHA-256: 054279221566b023655748b950e944eb4309563db213412ef8f179dc54cb7ed1
font_01_sfnt_off00010e31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E31 10696 bytes
SHA-256: 9c2993736441e6e1e4141b4f57d5d1d118448b6604a6877913ad8a7236b874e7

Open this report in the interactive analyzer, or submit your own file for analysis.