Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0cb2e13b295a707…

MALICIOUS

PDF

71.2 KB Created: 2021-03-26 07:19:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: c702782bc7ea50f1a73659e8bbdca0e8 SHA-1: 1a6a7a742802bc11bb1c0effaf0f4c0ffc176b3d SHA-256: a0cb2e13b295a707b10b7a0dfe1e5058a16a22d6dfc9b0ee4d2f7d68592d6227
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/strik?utm_term=live+like+a+dream+lyrics+30+seconds+to+mars PDF link annotation
    • http://gedatidigog.sportsontheweb.net/70458738290.pdfIn PDF document text
    • https://cdn.sqhk.co/tatogevi/ghid9hj/best_religious_apps_for_iphone.pdfIn PDF document text
    • http://zijukikov.mypressonline.com/the_masonic_bible.pdfIn PDF document text
    • https://cdn.sqhk.co/xavexapoxiv/eh6ljcm/62804367928.pdfIn PDF document text
    • http://nonretloli.site/jamoxepujiliwiwuboba6u3p3.pdfIn PDF document text
    • http://itdiscounts.pro/xobefifufuludoweligutosi2zfdf.pdfIn PDF document text
    • http://help-bluebadgecenter.com/can_you_sue_landlord_for_discrimination7j1v6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kevava/kufesunerebolu.pdfIn PDF document text
    • https://88211235-bf86-4d40-a6ec-a052db2f682e.filesusr.com/ugd/94e5ef_0af1b115d65f46158a9e161153b7a627.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jupudizadid/functional_training_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f3c35652-c629-4279-b116-14054a8ee87a/gokunidoz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b9e90a9-e37a-4648-9cf1-61ca457c9947/how_to_replace_motor_belt_on_proform_treadmill.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d2bb6eb7-047a-4ff3-8977-e3f2109222ac/97748254772.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d4ca928-1e44-4f61-a080-7d948fee2019/37321753850.pdfIn PDF document text
    • https://s3.amazonaws.com/jasadavebaga/sijobuwa.pdfIn PDF document text
    • https://s3.amazonaws.com/sojuravewi/kinematic_equations_p2_worksheet_answers.pdfIn PDF document text
    • https://a0bbd489-bf03-48a0-8e93-88abd0751e5b.filesusr.com/ugd/370ea2_e185e78a4aba4fb6bbbfddcf14392d00.pdf?index=trueIn PDF document text
    • http://jomupaz.myartsonline.com/sentinel_gun_safe_key.pdfIn PDF document text
    • https://d21da297-2d1c-4020-882f-059d99c29dc9.filesusr.com/ugd/3724a2_983166c3dcdb44f08d287293e87b3211.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/votubukaxogilix/gimowiwiriwulix.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d89e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD89E 5560 bytes
SHA-256: 7039614fe9e0b9c3250c1005aae52a7904eba1cb5f7e78afa89d288d973ca808
font_01_sfnt_off0000eb81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB81 10496 bytes
SHA-256: 67b90b8bd0570cf311a50a60bebd685f86dd156201c85c8ad271965dfa2ac0b2

Open this report in the interactive analyzer, or submit your own file for analysis.