Malicious PDF — malware analysis report

Static analysis result for SHA-256 945023be6d0b4fee…

MALICIOUS

PDF

71.4 KB Created: 2021-02-23 21:55:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 99d1a2a92dcab3d073c947e4069b1a27 SHA-1: deb6bba4c6a44b1aa3f93ad6160177bc82057b65 SHA-256: 945023be6d0b4feedc129b06dfd698258f07a941c8a12452eb9a2b65ee72adf1
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jacksth.ru/wix?keyword=asphalt+8+download+apk+data PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4485939/normal_60159b7d8f853.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387932/normal_5fce85367b217.pdfIn PDF document text
    • https://cdn.sqhk.co/jerowerar/jjsjfU7/79047192078.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458833/normal_601b180cc8cd9.pdfIn PDF document text
    • http://tarenutufitox.66ghz.com/astronomy_magazine_september_2018.pdfIn PDF document text
    • https://cdn.sqhk.co/vonitumefide/whOuhaX/barbie_dreamhouse_adventures_go_team_roberts_wikipedia.pdfIn PDF document text
    • https://cdn.sqhk.co/wifopuzuxiba/Gjegdu8/xurudisopu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416493/normal_60129633770c8.pdfIn PDF document text
    • http://fusobilel.iblogger.org/gnarls_barkley_crazy_free.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481662/normal_5fedcf1841311.pdfIn PDF document text
    • http://walkover.me/1071811033gkogb.pdfIn PDF document text
    • http://gouliwer.online/kathi_full_movie_in_720pd9k0z.pdfIn PDF document text
    • https://cdn.sqhk.co/muzubasiwu/Mqginjc/drill_down_in_table_visual_power_bi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xutomoxu/41180885967.pdfIn PDF document text
    • https://s3.amazonaws.com/pizivurapab/66046987607.pdfIn PDF document text
    • http://vozuxekeve.rf.gd/what_are_the_three_agricultural_revolutions.pdfIn PDF document text
    • https://s3.amazonaws.com/bolovopizonuki/binomial_probability_distribution_examples_and_solutions.pdfIn PDF document text
    • http://bajoparepodoze.epizy.com/what_tax_deductions_can_i_claim_on_my_investment_property.pdfIn PDF document text
    • https://s3.amazonaws.com/paxuvagal/sublime_text_3_html_formatter.pdfIn PDF document text
    • https://s3.amazonaws.com/remeranexe/minebewiwelidazibuparupar.pdfIn PDF document text
    • http://ridurosumebo.epizy.com/pugik.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d513.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD513 5288 bytes
SHA-256: 2628046dc6fcc4d55c906bc03e960682714e9b82664a342ff4d29396791c5919
font_01_sfnt_off0000e723.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE723 15144 bytes
SHA-256: a080471678627237587fd10a22605d42601a6a995380fc033ce4d6b925d00985

Open this report in the interactive analyzer, or submit your own file for analysis.