Malicious PDF — malware analysis report

Static analysis result for SHA-256 a03210bf1abad08f…

MALICIOUS

PDF

84.9 KB Created: 2021-03-18 06:52:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 2760e4633762bb13e4d811fc13e55873 SHA-1: 160b4256b3811712dc6fb05cb2f210db45570633 SHA-256: a03210bf1abad08face348101fcf7e02867e5eab29b73cd2d536cd39e99d7975
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=quotes+from+lullaby+by+chuck+palahniuk PDF link annotation
    • https://cdn.sqhk.co/pulovafafita/ikYieMm/jidekuvemizabe.pdfIn PDF document text
    • http://babbieshop.ru/430176639881u78a.pdfIn PDF document text
    • http://megatorg.ru/husqvarna_chainsaw_435_change_chain10iw0.pdfIn PDF document text
    • https://cdn.sqhk.co/baluwofuk/2pQigSX/74344009183.pdfIn PDF document text
    • http://cardioactiveuficiale.site/34733036688l360c.pdfIn PDF document text
    • https://cdn.sqhk.co/tapowifilez/ihF3mii/font_asset_not_found_android_studio.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nevowimo/wavim.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/177b67c0-1276-45ec-b02f-889884f57842/public_health_merit_badge_pamphlet_download.pdfIn PDF document text
    • https://s3.amazonaws.com/zerepuzuze/the_high_court_of_australia_information.pdfIn PDF document text
    • https://s3.amazonaws.com/liwafo/jezemulalarozewexe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/16db29b8-f939-4153-b383-dae4199eca95/kenuvuwamakimijum.pdfIn PDF document text
    • https://s3.amazonaws.com/dupula/what_percentage_of_the_canadian_population_has_diabetes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/248f3347-981a-4807-a606-fb7cc17ab920/rexowokigaporopesitot.pdfIn PDF document text
    • https://s3.amazonaws.com/nalifij/free_curriculum_vitae_template_nz.pdfIn PDF document text
    • https://s3.amazonaws.com/megodipewukitoj/how_to_start_a_blog_tutorial_for_beginners.pdfIn PDF document text
    • https://s3.amazonaws.com/rikolesafuwofar/installation_progress_report_template.pdfIn PDF document text
    • https://s3.amazonaws.com/ninazarila/donibivexiwozokovamono.pdfIn PDF document text
    • https://s3.amazonaws.com/nijudow/66931175527.pdfIn PDF document text
    • https://s3.amazonaws.com/fekaduvopigab/28555153393.pdfIn PDF document text
    • https://s3.amazonaws.com/rejiner/68910743389.pdfIn PDF document text
    • https://s3.amazonaws.com/sinamozagemoger/26724839580.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/08fceffb-27ed-40ac-a8f3-44da10797df7/ninonadegusarewenabil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4bd4a11e-d2fe-4ba5-aaac-8cb373313e5a/panasonic_bluetooth_answering_machine_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/zalomi/dominik_kahun_scouting_report.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011069.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11069 5624 bytes
SHA-256: 575250ec3ad94ae94d980ce8b6c1fc55fa68ef225c212a640764268398ca829d
font_01_sfnt_off0001235d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1235D 10436 bytes
SHA-256: 7854dde1220dc0a36359ca92d12fe63d5d61b1d0f536c9c7815e1f6b43623e48

Open this report in the interactive analyzer, or submit your own file for analysis.