Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ea1403a66f3d348…

MALICIOUS

PDF

71.7 KB Created: 2021-03-05 00:37:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 80ae44a2354936a67293f70cb0c6e7de SHA-1: 55fabd0c89c36f6b1834a73d9de91cd90fee48d7 SHA-256: 9ea1403a66f3d348e80b1ea23ee9b3df0f2689cc2d6cced2dc8e9e4fb844d3ab
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/wix?keyword=words+with+ew PDF link annotation
    • http://zizodoroluxonaf.sportsontheweb.net/the_crucible_act_1_notes.pdfIn PDF document text
    • http://reactivaperu-2020.com/wasaruvufagurikozopozf5hfb.pdfIn PDF document text
    • http://dfds.in/42862740186lw9r.pdfIn PDF document text
    • http://jirenaxapibetig.scienceontheweb.net/monster_3.5_mm_extension_cable_walmart.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425760/normal_600a06b2218a7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450003/normal_6004b702315d1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4418584/normal_60027544dfff1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387815/normal_5fe6630db6e7b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/150171dd-fa23-4b75-90a6-260a7e72a382/soviwexaxowajegavetak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/69db9a57-0fba-4e91-b903-95e04068b3d8/how_do_i_get_a_stray_cat_neutered.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/08e5fe39-e153-443b-81b7-6c8135a56c13/83758459583.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4a07eaf-f83f-405f-9f3a-6327c0d1c737/9637248932.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/28e32363-e4bb-455c-9ffc-807fc85a37bc/how_to_sync_skullcandy_push_wireless_earbuds.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e156aaca-4c15-488d-9409-516aabf460aa/daramuzulafatojisebo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb61d1ad-cf63-4a3a-b4eb-42e669360c26/12622240752.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8014df69-28d6-4585-84ee-94256e27cd34/what_does_it_mean_to_interpret_the_bible_literally.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82d01638-211e-439a-9b55-8f79647744a3/serta_icomfort_motion_perfect_3_adjustable_bed-_king.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e1d219d-d3c5-4fe8-82da-b365044b3161/how_to_put_kitchenaid_fridge_in_demo_mode.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7504573f-a878-40c9-915e-92f5267551ba/xbox_one_controller_pc_driver_windows_10_64_bit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11ffe407-32c7-40d1-99e9-61d5958283a8/81730247740.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD77 4776 bytes
SHA-256: 7645975a187e023093b5fad90822e37f5a6fc95c102885b24c9f9180e384d496
font_01_sfnt_off0000edc6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDC6 10604 bytes
SHA-256: 008416b1a5fcff9f87f7decfbdd149e07791470adabc9f638bfd092980ab5839

Open this report in the interactive analyzer, or submit your own file for analysis.