Malicious PDF — malware analysis report

Static analysis result for SHA-256 931b440da6d5f14b…

MALICIOUS

PDF

441.2 KB Created: 2021-03-25 10:47:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 4a7206481e216e569df25170c0160386 SHA-1: 76550334fb3b320c3cbff903a7b97644e1dd8da4 SHA-256: 931b440da6d5f14bfa682989de8d59dad7eb2cc8937b4cb977a6d51767bffbc9
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7716

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/wix?keyword=bakugan+leonidas+reddit PDF link annotation
    • https://rinulokol.weebly.com/uploads/1/3/4/8/134868038/mijagako.pdfIn PDF document text
    • https://vawosikajoj.weebly.com/uploads/1/3/1/4/131438279/buwerogami-wigafitej-vugefogimegefi.pdfIn PDF document text
    • http://sunufosabupes.scienceontheweb.net/2020_calendar_canada.pdfIn PDF document text
    • http://zugemenelil.medianewsonline.com/maya_angelou_still_i_rise.pdfIn PDF document text
    • http://nokiwurugibub.mypressonline.com/cataract_pathophysiology.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/lorugipopuxe/98779096197.pdfIn PDF document text
    • https://9eaa565e-fb97-40b4-b096-d6760803f699.filesusr.com/ugd/55e2c6_a1baba9c90da42a683b79818f4d22623.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d38d2e7a-50a4-4ab5-8d8f-91e93653ede5/nijenigamokigeneveju.pdfIn PDF document text
    • https://s3.amazonaws.com/sesafefanulokam/85253628749.pdfIn PDF document text
    • http://pimoxonevuwewax.atwebpages.com/aha_bls_handbook.pdfIn PDF document text
    • http://vufagozujidivu.epizy.com/preschool_teacher_introduction_letter_to_parents_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd747d40-e930-483b-a734-84bef8bb88b2/tascam_dr-60d_mkii_timecode.pdfIn PDF document text
    • http://xalikitu.epizy.com/free_sewing_books.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c4572fb9-d642-412b-8e9f-e10814987443/fotapapol.pdfIn PDF document text
    • http://rozipiliwune.epizy.com/89723015893.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f37eec2d-8de9-4520-9d90-f0e14dd469ec/organos_que_conforman_el_sistema_endocrino_y_su_funcion.pdfIn PDF document text
    • https://s3.amazonaws.com/fefurorobumi/mulerukanirev.pdfIn PDF document text
    • https://77da94c0-0f0a-445b-87af-e489a0b5ef66.filesusr.com/ugd/db1da1_2c645f5bc6db4439a0e2e763e6bff250.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/af3c61f2-9ef1-4a64-9a1d-62602bbdf586/86517975355.pdfIn PDF document text
    • https://2e4d99de-9d37-4ce2-abd5-0bbccafdbe51.filesusr.com/ugd/33a2e4_35e5ec25a5be4f4fb3aa7cdaacc0798d.pdf?index=trueIn PDF document text
    • https://4c982f7a-b72b-446d-8c7a-5e2d6818c0db.filesusr.com/ugd/519a61_4dd8bf8bb2be4172abf4822b170ee37b.pdf?index=trueIn PDF document text
    • https://9eb5ee95-128e-4115-bcd6-d8db8525ce49.filesusr.com/ugd/9904c2_b09bf77eaa0149ddb4c36f4b4eca9c05.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vojapu/gregory_pediatric_anesthesia.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000683ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x683FF 5104 bytes
SHA-256: b9db5e2d5b2562bc6710147b889dcec6234e9080fb02b1627ffeb6254a9e8525
font_01_sfnt_off00069570.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x69570 12060 bytes
SHA-256: f80030df52a57db734ac417ff1322a497364d82a29d0658e069de8977f985701
font_02_sfnt_off0006bd27.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BD27 16092 bytes
SHA-256: 39b2f4b99ee08965fd4836f89f628a00cde8346cb181131bba0308e80db8fb67

Open this report in the interactive analyzer, or submit your own file for analysis.