Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f1e3f0215c36c98…

MALICIOUS

PDF

90.5 KB Created: 2021-05-20 17:20:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 4dbf895d33579e3d6a9248f89c876e7c SHA-1: 8b3db0eadfd9c4ff7b306fbac2a6bfadbdeaff17 SHA-256: 9f1e3f0215c36c98c587abe602e6663016877577e0f1a07e7f118e9fd3df6bfb
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=hein+gericke+size+guide PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4488574/normal_606c3d483d6c4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4462379/normal_6005b2d7e6f5a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4497344/normal_6038be8a4d061.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4484358/normal_5fcf7485d5272.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372987/normal_602a880842fb4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500893/normal_604700433784c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/de7eab82-6058-4079-93f0-853adc696899/adobe_photoshop_7.0_bangla_tutorial_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/mupukesunobaga/how_do_plants_help_to_reduce_global_warming.pdfIn PDF document text
    • https://s3.amazonaws.com/dikobepibelun/3870031605.pdfIn PDF document text
    • https://s3.amazonaws.com/lewuli/general_mathematics_textbook.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1552c925-82eb-4a93-95f1-1054fab57007/honda_eu3000is_owners_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/votubukaxogilix/black_dress_plus_size_formal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0200fe4f-f06a-464c-b701-503bc3641375/rowenta_handheld_steamer_canada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/553ba012-dde0-481c-b61c-3998f06f4e51/53295811530.pdfIn PDF document text
    • https://s3.amazonaws.com/gixirojozogufux/ffiec_guidelines_charge_off.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/997ff499-ff50-4f58-939d-efd14026476c/72215955769.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/108800f9-2091-4b81-9eb2-ea73e8a08e75/how_to_tell_if_infant_has_ear_infection.pdfIn PDF document text
    • https://s3.amazonaws.com/tufitijinexu/18936708271.pdfIn PDF document text
    • https://s3.amazonaws.com/tofizo/cdna_pcr_template_concentration.pdfIn PDF document text
    • https://s3.amazonaws.com/besafefaf/zewagokuwobaxipup.pdfIn PDF document text
    • https://s3.amazonaws.com/kefefetafij/44858540058.pdfIn PDF document text
    • https://s3.amazonaws.com/resisuna/vajakaranu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec76605d-1561-48c0-95c8-6ada7f3dec35/27827176308.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012320.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12320 4940 bytes
SHA-256: a75b2c997c3d63e19d63bce0aa78aa5139673cd3564c7c5cdb3a301597cba5ad
font_01_sfnt_off00013409.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13409 12260 bytes
SHA-256: fd6da9d56db0f4a1f1a15ed10fb2f9564ffaf91a7857e7ae940232c344ab7263

Open this report in the interactive analyzer, or submit your own file for analysis.