Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1879eb0572566d0…

MALICIOUS

PDF

70.8 KB Created: 2021-03-24 21:12:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 9f22f4af764d9ca1d0acc2ca20ddf4ea SHA-1: c9c15e8bd7b9ff6baad6e3988a1b27a6a6581846 SHA-256: a1879eb0572566d000c6b8658f0af303c9f4335f8223eb0d4cf2044b9317312f
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/123?utm_term=agito+cosmos+pdf PDF link annotation
    • http://bajifepeselok.sportsontheweb.net/pilesegimefijug.pdfIn PDF document text
    • http://tizezs.xyz/bebibezobuvamk2xh.pdfIn PDF document text
    • http://dubaxerunonafu.iblogger.org/tijowokawozatipu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384152/normal_5fdb3abdb62f7.pdfIn PDF document text
    • http://shopbest.online/how_to_bypass_ipod_touch_activation_lock7j8lj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383928/normal_604f7b3624f26.pdfIn PDF document text
    • http://xivibogo.22web.org/80273416401.pdfIn PDF document text
    • http://javaxirivibewi.mygamesonline.org/pixegamof.pdfIn PDF document text
    • http://tuwukadinem.mygamesonline.org/82418660848.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/ziwuvijevo/descargar_paint_the_town_red_android.pdfIn PDF document text
    • http://dozuxix.myartsonline.com/2975357854.pdfIn PDF document text
    • http://zarugosa.epizy.com/canchas_de_futbol_7_cerca_de_reforma.pdfIn PDF document text
    • https://s3.amazonaws.com/wazorixekunafob/50852636642.pdfIn PDF document text
    • https://s3.amazonaws.com/bufipevuril/60105531495.pdfIn PDF document text
    • https://s3.amazonaws.com/mamibis/hubert_und_staller_staffel_4_episodenguide.pdfIn PDF document text
    • https://s3.amazonaws.com/buwosevax/polaroid_onestep_close_up_battery.pdfIn PDF document text
    • http://virojokezof.rf.gd/72661234139.pdfIn PDF document text
    • https://s3.amazonaws.com/lowuwofuxali/vupugifamimajevitosegetu.pdfIn PDF document text
    • https://s3.amazonaws.com/fobupojowojon/net_speed_monitor_app.pdfIn PDF document text
    • https://s3.amazonaws.com/vexeliku/75961370934.pdfIn PDF document text
    • https://s3.amazonaws.com/sixolose/platform_film_ka_gana_dj_song.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d69a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD69A 5124 bytes
SHA-256: 7cbaca67ed99129b5befebb8bd967b68a259b6b355ff76a30b37715dbda7188a
font_01_sfnt_off0000e80c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE80C 11768 bytes
SHA-256: 38c4627f8f53210f9e3aa9f7c4637cc5863f72673795af190f6e24a55dd34d62

Open this report in the interactive analyzer, or submit your own file for analysis.