Malicious PDF — malware analysis report

Static analysis result for SHA-256 98b9b2f779c9b337…

MALICIOUS

PDF

76.6 KB Created: 2021-05-19 18:15:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: c63ffe72e75ad1308862041999d482e8 SHA-1: 5203e2e012666ea48e7aec6714c5160da6544876 SHA-256: 98b9b2f779c9b337cf9a39680899d8a79d9e2e592028d828c2effec0a6f282c2
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=how+to+make+a+pro+forma+balance+sheet PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4449184/normal_6057974cc0e09.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409257/normal_6041e32d5041c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444885/normal_5ffa51b492819.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4461766/normal_5ff457c8de325.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472793/normal_603cec4d84b2c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413867/normal_5ff7fe91428c5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501046/normal_606e101f886ac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408177/normal_606a09c8edfde.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454543/normal_5fed0fb20a5d6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408346/normal_6040a58f35f3a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446776/normal_60045c50550b4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4390996/normal_6002eb299e429.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/25e0599b-8656-408f-a420-9180e4df4396/macbeth_act_2_scene_3_modern_english.pdfIn PDF document text
    • https://s3.amazonaws.com/zidosozawok/the_vampire_diaries_script_season_1_episode_10.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cbe338d0-bd67-4639-bc2a-1c6c07c1153d/epson_m244a_service_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3d57869-9c96-4cb2-b6bf-e5c9c10ea239/dirt_devil_featherlite_cyclonic_how_to_clean_filter.pdfIn PDF document text
    • https://s3.amazonaws.com/rexogeguxosix/8697837130.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/23dda9bf-7ee7-46cc-b3e5-f9ad8e0add3b/units_of_measurement_king_henry_died_by_drinking_chocolate_milk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/37d882bf-1535-4c50-9da4-67637e6e1d9b/what_is_the_4th_industrial_revolution_all_about.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/afc6d984-110d-4818-83e9-64c28e3a9a7e/dell_optiplex_755_motherboard_drivers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d1a418a-0a12-4abd-9154-4848430a0600/42560995988.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecda.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECDA 5512 bytes
SHA-256: ce7ce9fb3f1166c7d85b103ee1ba6194b31d6de12647168264ff9a3891513fb6
font_01_sfnt_off0000ff81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF81 10988 bytes
SHA-256: 992e3150cd32e40993e7e257159cd3d0a124dbdb3ea9fcd8a4cb8651b8cf4b47

Open this report in the interactive analyzer, or submit your own file for analysis.