Malicious PDF — malware analysis report

Static analysis result for SHA-256 9bd96c63392f5fc0…

MALICIOUS

PDF

87.5 KB Created: 2020-12-03 15:47:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 38bf0d267d7ccb792d93136bf959b5fd SHA-1: 15fb3fb1069d018567ee4b8e69d2931d49bfd192 SHA-256: 9bd96c63392f5fc0f75b605790fd4e344a6eac05c1aa538595461d02cf2a942b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/strik?utm_term=stonewall+jackson+high+school+va PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4416665/normal_5fbd4c5b6827f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369146/normal_5fbdcaef765b1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc0c3cd92c50b1a1e76da16/t/5fc550a5f3de5e49b5154e44/1606766769709/punalopomiv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/16b9fac9-0d9d-411f-8ae5-7fde03a5b67a/wepunemuw.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd1a52b24ece27e9143ef8/1606228562941/sinnoh_elite_four_pokemon_revolution.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1321e2e34347c7045f8f9/t/5fc368202dd96f5918598fef/1606641698090/dafuta.pdfIn PDF document text
    • https://s3.amazonaws.com/widiku/imanage_work_10_server_installation_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/xedewofuretujo/lidenudapuw.pdfIn PDF document text
    • https://s3.amazonaws.com/lodazojamuva/sowizeg.pdfIn PDF document text
    • https://s3.amazonaws.com/bokofapig/kindle_format_to.pdfIn PDF document text
    • https://s3.amazonaws.com/luropi/94218183622.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd1e0212914f58d3e43c06/1606229506913/50345988303.pdfIn PDF document text
    • https://s3.amazonaws.com/debiwelof/voduponiposixunezoxinemi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca0ea143-00ac-40ae-8602-2ac4f078a9cf/best_day_of_my_life_karaoke_mp3_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/mubefula/ratio_and_root_test_for_convergence_of_series.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00012102.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x12102 26952 bytes
SHA-256: 4b0f2de9843dbca1f1e000f5836f5fd6e45fbcea050c2d33341632e88943c416
font_00_sfnt_off0000e784.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE784 5360 bytes
SHA-256: 9d74645ca5d68d6ec29bf7e93f089f217a90aac857bdee286471080a2c9cb821
font_01_sfnt_off0000f9e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9E0 11448 bytes
SHA-256: ec54ba3b75585cc6bb60a6647102a5640217079060d98b849304a4217dda9d84

Open this report in the interactive analyzer, or submit your own file for analysis.