Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ca16595b62e07b7…

MALICIOUS

PDF

86.4 KB Created: 2021-03-18 02:23:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: d1c49bfa877577b69e4462bb4c488d1b SHA-1: 22989dd847f4809af4559ed652e590c1894fd77d SHA-256: 9ca16595b62e07b7ebcf72e856b446e8926174e066855ce44b543ae5d9635c37
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/aws?utm_term=are+tracfones+good+for+seniors PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4380076/normal_5fd7a0106156a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489844/normal_5ff7179968628.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403543/normal_602096d9d2c54.pdfIn PDF document text
    • http://afracheat5.xyz/google_maps_street_view_not_working_ipad9amf2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457014/normal_601ad58cb2231.pdfIn PDF document text
    • http://glawerry.online/69393672847dzdhs.pdfIn PDF document text
    • http://fapseo.ru/ronusugalozeduxanaoe0m7.pdfIn PDF document text
    • http://bit7.top/785012438349atc4.pdfIn PDF document text
    • https://cdn.sqhk.co/fekolisuzub/hjvTihS/kiberusoximine.pdfIn PDF document text
    • http://goods-amzon.com/flexible_dieting_bulking_meal_plan0430t.pdfIn PDF document text
    • http://auto-agents.space/jazezivo4mfga.pdfIn PDF document text
    • https://cdn.sqhk.co/bepasasa/fOjaiii/fabora.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4372361/normal_5ffeb5c5bdfe4.pdfIn PDF document text
    • http://zavarivaemvmeste.ru/risk_assessed_management_plan_liquor_template_qldmra1u.pdfIn PDF document text
    • http://agent-spv.space/gojogisotevepadobopudiim6ff.pdfIn PDF document text
    • http://winfreeiphone.xyz/tv_channel_logo_quiz_answersarcui.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gezetega/what_were_the_primary_reasons_for_the_fall_of_rome_essay.pdfIn PDF document text
    • https://s3.amazonaws.com/gapivegek/soldier_13_performance_review.pdfIn PDF document text
    • https://s3.amazonaws.com/numegubowalonan/93610174684.pdfIn PDF document text
    • https://s3.amazonaws.com/zosevid/rascal_600_scooter_for_sale.pdfIn PDF document text
    • https://s3.amazonaws.com/fadedosi/core_java_syllabus_by_oracle.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011568.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11568 5144 bytes
SHA-256: 51ccab044bfefb88d2fe6734fd2ef5c51cd92795a317fad0d88ea490050ee517
font_01_sfnt_off000126f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126F9 10968 bytes
SHA-256: 928e119e2717ebb5f13f993f09c7b884faa2ebf54552366e7c791d816825b23c

Open this report in the interactive analyzer, or submit your own file for analysis.