Malicious PDF — malware analysis report

Static analysis result for SHA-256 904e5dee01fe8b25…

MALICIOUS

PDF

71.9 KB Created: 2021-04-02 21:26:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 038271679776feb2e7c149a6f62f7ed5 SHA-1: df17be011aaacaa032b62fb137b9bf6bfe111c87 SHA-256: 904e5dee01fe8b25d989af7a245645e9406e9e2df0508a0d6fbde73145811c9e
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=can+physical+therapists+cure+scoliosis PDF link annotation
    • https://tinedejoditof.weebly.com/uploads/1/3/5/9/135971312/c8bed6d6f041.pdfIn PDF document text
    • https://cdn.sqhk.co/bevoroxur/h1gh3hd/translate_spanish_menu.pdfIn PDF document text
    • http://juvovagesubo.mywebcommunity.org/pigafizafum.pdfIn PDF document text
    • https://kizevopizimi.weebly.com/uploads/1/3/5/3/135351298/tasixa.pdfIn PDF document text
    • https://wirupexulabajes.weebly.com/uploads/1/3/5/3/135322132/kipabanogax.pdfIn PDF document text
    • https://cdn.sqhk.co/xuwifoviwalo/hR92uKT/wukigufuwakepo.pdfIn PDF document text
    • https://bexopugizabon.weebly.com/uploads/1/3/4/0/134042324/fowevaxafare-monexaloroweke.pdfIn PDF document text
    • http://nufivuzelikonax.getenjoyment.net/important_synonyms_and_antonyms_for_ssc_stenographer.pdfIn PDF document text
    • http://dudoxanudito.scienceontheweb.net/bank_teller_interview_questions_and_answers_examples.pdfIn PDF document text
    • http://draiwenstore.online/tv_ears_5.0_dual_digital_reviewslbfss.pdfIn PDF document text
    • http://sakhavto.ru/62594116566h40q5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xidulumexi/90849988877.pdfIn PDF document text
    • http://keregimuw.onlinewebshop.net/amenorrhea_aafp.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/04dbded9-de59-480a-aea9-ed3328c9b96e/bovotexab.pdfIn PDF document text
    • https://s3.amazonaws.com/rirusozo/xagatasadojawusadikone.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff9fb8a9-6c51-4048-9719-349fb5d6d0eb/troubleshoot_atwood_hot_water_heater.pdfIn PDF document text
    • https://s3.amazonaws.com/nitajosasa/compare_and_contrast_character_traits_worksheets.pdfIn PDF document text
    • http://tudugir.atwebpages.com/late_adulthood_development.pdfIn PDF document text
    • https://s3.amazonaws.com/dapekufoxiraku/vba_macro_to_list_sheet_names.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a834b723-683c-4874-b595-d5c58e32316d/felekonabogimazawe.pdfIn PDF document text
    • https://s3.amazonaws.com/xidazeze/88760286195.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dcfa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDCFA 5028 bytes
SHA-256: 736b4344d5ff53842ce6c002f7472a00a9e84d7171366bfe0cdd9745c50cd715
font_01_sfnt_off0000ee10.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE10 10516 bytes
SHA-256: 1c5d0fcb00f93bd14d4047977d9d4df80b2e641921ee0b93f5ec9dd15e3dcbc6

Open this report in the interactive analyzer, or submit your own file for analysis.