Malicious PDF — malware analysis report

Static analysis result for SHA-256 9aecfdcc158a5fe7…

MALICIOUS

PDF

183.3 KB Created: 2021-03-11 08:02:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: b06912fcb9994f97d8e985e1b63f785e SHA-1: 9a995e106abef8a043c2bbe31edba2b00fcb9328 SHA-256: 9aecfdcc158a5fe7270d149535fe4137e5536b9699cd21b7cc4477d06a735988
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=cutaneous+respiration+in+frog+pdf PDF link annotation
    • http://luwogexejel.getenjoyment.net/basizamibadakor.pdfIn PDF document text
    • http://tiriruno.sportsontheweb.net/78708630433.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://pulitisagot.atwebpages.com/the_checklist_manifesto_archive_org.pdfIn PDF document text
    • https://s3.amazonaws.com/voxipanovigepiv/10671459613.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ff1000c-cd8e-4af3-80d3-b35a40bbb4ce/59763699699.pdfIn PDF document text
    • https://s3.amazonaws.com/jiguwuzobozobaz/razozaxux.pdfIn PDF document text
    • http://xovolefewawex.atwebpages.com/origami_diagrams_intermediate.pdfIn PDF document text
    • https://s3.amazonaws.com/nisoxow/charriol_ring_size_guide.pdfIn PDF document text
    • https://78905da9-dd21-4190-abaa-c894c042e703.filesusr.com/ugd/851c7c_5433970448c1441cb50af6c162829f3e.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4c9487d-510e-41f8-ad55-3af7ae923a1e/assassins_creed_valhalla_transcript.pdfIn PDF document text
    • https://171e2b11-24ea-4535-acac-f971ec821c4b.filesusr.com/ugd/a07927_b3007818de4d4b8c8aef13b7fe2fbedc.pdf?index=trueIn PDF document text
    • https://cc46d2ba-e7cf-42f8-aa62-b015a0c17ef0.filesusr.com/ugd/d180c3_569039d2c71a4f5c9f6a8c2072690199.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9da746f-57b3-43e0-bd54-dcfc81562c83/on_the_banks_of_plum_creek_chapter_8.pdfIn PDF document text
    • https://52468903-0e2d-47c5-babb-61e1d305d291.filesusr.com/ugd/32777b_72efef030ef34fb4bef8cd8f896222ed.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nagudo/27995101275.pdfIn PDF document text
    • https://cb8582fb-ab29-4f13-bfd4-623ca244ab52.filesusr.com/ugd/d61b30_7fa2cbd3a0954c1e852bf32303f5c4d4.pdf?index=trueIn PDF document text
    • https://4b4ea461-5266-411b-8735-d5290551f550.filesusr.com/ugd/7fedcf_4955d6e0f8244e2e99d2f8c3a0057b83.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/a91ec465-ca26-4d65-b5f4-3b58c712a2b2/tissot_1853_powermatic_80_le_locle.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55e50178-0dfa-446b-974a-a6e53db9b548/73240392172.pdfIn PDF document text
    • https://a7193630-a032-4ee2-b136-33837135b76a.filesusr.com/ugd/fac845_d477b69fb32c43f6a51e7ab260a21e55.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gozifep/10866355702.pdfIn PDF document text
    • https://6c473ef0-402e-45f0-9f95-6bc7e89a6a1a.filesusr.com/ugd/5518c3_aae452f875fc4c4bbdc35cffce900643.pdf?index=trueIn PDF document text
    • https://b32521b7-32ca-447e-9967-d27d0dce683d.filesusr.com/ugd/800b88_fe690d1e695e43399c9b37bf5226c00e.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00027614.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27614 5084 bytes
SHA-256: 1c7e75cca3829f51d4ad9de2919ffa252107d25199041e043c68d1ab70c34fba
font_01_sfnt_off0002876c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2876C 15752 bytes
SHA-256: a8e3bcd95fcfcc5804378cd5bd0d0887257f01b67daf59481df7000d060b5065
font_02_sfnt_off0002b997.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B997 16176 bytes
SHA-256: 2c78d98e1fac6ca8e0b8f589f6f008a5723fb819d39ad572f30998e947ad7810

Open this report in the interactive analyzer, or submit your own file for analysis.