Malicious PDF — malware analysis report

Static analysis result for SHA-256 a21d1ad1168fb5f7…

MALICIOUS

PDF

69.5 KB Created: 2020-12-01 07:13:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-01
MD5: e501bec34b5789251adbce0595f44f95 SHA-1: d8b499c50fc43129f9b891d60edc49ebce3b896a SHA-256: a21d1ad1168fb5f7aa6b6538ba4b375813f6dbad02114eedfb45e4866ae65d5e
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/strik?utm_term=stephen+curry+wingspan+in+feet PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae05e03f-a4bf-4c34-ad69-eaf69aca9f5d/20075414178.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdef215147b14804f7c889/1606283047208/pegodalubatijowexugefut.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc011b424b06a7eb3fa7d30/t/5fc19fd0cb3e0f57718d5206/1606524881495/vinyl_sticker_machine_for_sale.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc16072e9fc3622d52570ce/t/5fc34fabe6d49a06bbfca246/1606635436215/island_of_the_blue_dolphins_crossword_puzzle_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/901c8782-7e62-4253-9b45-f433c700c222/peluget.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40d3d0ce-8ef2-472e-b8c7-9105e2c6c0cb/mta_retirement_age.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0ea21e2fce462bc8c0024/t/5fc211193f75b166431b8ca8/1606553882656/phim_kiem_hiep.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33d175ec-31da-4325-87a9-ec8bf4133479/40934434865.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3616665-0711-4640-a72d-d5503fb85b8b/pafotagaxa.pdfIn PDF document text
    • https://s3.amazonaws.com/vibove/eastbay_return_policy_canada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10c8a037-e84c-4734-88d7-f0666d347c8d/20906826517.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe03ca08845d092450f098/1606288331677/universal_android_root_apk_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d351.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD351 5544 bytes
SHA-256: 2b08ba131d1e2d62782d0d54957feee741ea0c2c6735ac758c44a95205c384fb
font_01_sfnt_off0000e64d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE64D 10332 bytes
SHA-256: 9e51523d73fb42d557cd8200ea23361e2ba1c4e7d6d7edd98018539c01b6f808

Open this report in the interactive analyzer, or submit your own file for analysis.