Malicious PDF — malware analysis report

Static analysis result for SHA-256 8fe6c5960ddc528b…

MALICIOUS

PDF

93.1 KB Created: 2021-04-05 06:15:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: fd553e595a4fcc3e291726a4da76e32a SHA-1: c993573befda21eea46f064f3a94eb5a8408b026 SHA-256: 8fe6c5960ddc528b806477e12353589edb8e48e8cf3dca09851972ca39b21303
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9950

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/wix?keyword=ultra+video+splitter PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4388178/normal_5fe9d3c205bbb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409602/normal_603b2cd13f549.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427799/normal_6012fe86ac779.pdfIn PDF document text
    • https://cdn.sqhk.co/xerolunem/agfjhgh/21023360834.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444655/normal_5ffd6640b6483.pdfIn PDF document text
    • https://cdn.sqhk.co/besogevipadi/jeWigZ8/79027622846.pdfIn PDF document text
    • https://cdn.sqhk.co/totarujined/phelhaJ/social_media_icon_set_psd_free.pdfIn PDF document text
    • https://cdn.sqhk.co/podogule/bieiiib/bomb_suit_manufacturers_canada.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495536/normal_60679e524fdd1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476142/normal_6054324146dbd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424933/normal_605955b2c8b86.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4505837/normal_5fda83ae730e2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4474977/normal_6004ed6405b94.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d964650e-c218-4f9f-84cb-46ce87bd6499/renaissance_dbq_the_printing_press_student_worksheet_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/dipafuxe/xelekolefovox.pdfIn PDF document text
    • https://s3.amazonaws.com/luworizesupox/horus_heresy_book_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d7d3b8d2-32ec-4c75-adfa-65b7d9bfabd4/50036968017.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9740e8d5-2f98-4e29-a660-2288d7344c87/how_to_write_the_introduction_of_a_business_plan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2cb29765-ad05-4682-94a2-99d2e6def9a6/how_to_calibrate_compass_on_iphone_11_pro_max.pdfIn PDF document text
    • https://s3.amazonaws.com/bevarolimesale/nintendo_switch_emulator_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47c734ac-d8f4-4c99-9d02-b440d256d4f0/mode_median_mean_range_maths_song.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a0f06c33-b871-4473-a2f8-5e2cba208b4c/pentair_minimax_nt_400_service_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/mogedozara/amrita_pritam_books_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a10c28ec-5822-427a-9db6-c89e6e0d0b71/ramifefinipopafotane.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc0ed060-2553-4581-b18a-af59f5a53e6f/mfj_945e_mobile_tuner.pdfIn PDF document text
    • https://s3.amazonaws.com/gajabedafot/zadebakunewokadige.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000138de.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x138DE 26076 bytes
SHA-256: 2cf3e6ad0084f61b24437c88fece95979b245c14a4dfdaff2bab87de02674b96
font_00_sfnt_off00010207.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10207 5004 bytes
SHA-256: 1b8100e2213e88791e61e4108368c9423fa0d605fcde2b56f97646d605801d3a
font_01_sfnt_off00011322.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11322 10912 bytes
SHA-256: 74d64fbacdd55ad57bd13bbb376b01ebca5d95015455c4b529e5a990a57da98f

Open this report in the interactive analyzer, or submit your own file for analysis.