Malicious PDF — malware analysis report

Static analysis result for SHA-256 a12da4d6d12231d4…

MALICIOUS

PDF

73.6 KB Created: 2021-03-27 23:17:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 7b316925a0e8295debd6a09766712ced SHA-1: 40c51086fe4144683797f049f71325b234ee2881 SHA-256: a12da4d6d12231d4c5db12c133f61c5ac708aa0df646c608e3c5630815817d72
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/award?keyword=bacterina+triple+bovina+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4417527/normal_60050d2e809b1.pdfIn PDF document text
    • http://vawuxipofuf.iblogger.org/kifelib.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383561/normal_605b821382c0b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419002/normal_602812f2b6e44.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382617/normal_60170ca5a4aa2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488569/normal_6023dbf8f2706.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475720/normal_60463b7055a91.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385427/normal_5fe5c51f1dc05.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384320/normal_5ffeabcfc6a61.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/39cdff2d-cc52-4a16-bc6f-23ac04cf49a7/how_do_i_setup_my_edimax_router_as_a_repeater.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3711dda5-d66a-4a7c-be76-584b85592d73/zedemewufudipopuluko.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ef11f902-2b0e-4c26-8491-cd624eca452a/how_to_adjust_herman_miller_aeron_chair_size_b.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a4d99842-cfd6-4906-b6c0-59ff45a6d394/which_term_defines_the_role_of_an_organism_in_an_ecosystem.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7546a8ab-bac0-4c11-9c6d-88c7ff394e06/2051016176.pdfIn PDF document text
    • http://tosakiviga.rf.gd/anonymous_browser_for_pc_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bae3a05d-c44a-4a50-857b-e8b3c8d3b418/bitodokijerususidatu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b256c6a-179e-4999-adb3-62ffd2a1541d/91701492079.pdfIn PDF document text
    • https://s3.amazonaws.com/ragejufa/63620622572.pdfIn PDF document text
    • https://s3.amazonaws.com/vavale/18660451836.pdfIn PDF document text
    • https://s3.amazonaws.com/zunaporam/11027825801.pdfIn PDF document text
    • http://jimogorop.rf.gd/antimanual_de_filosofa_de_michel_onfray.pdfIn PDF document text
    • https://s3.amazonaws.com/pizexopenaxu/bad_boy_ringtone_remix.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE3D 5220 bytes
SHA-256: 20feb230b6306bd5a0f446b53bfc4c684eb0be6c97a2361d9c3e11a028c05f76
font_01_sfnt_off0000f00f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF00F 12196 bytes
SHA-256: 9fcd837cc939282245e198a9ccf5a4b18a97442ed12b1278fd9176ab4eaa076f

Open this report in the interactive analyzer, or submit your own file for analysis.