Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2b890641fed6634…

MALICIOUS

PDF

75.9 KB Created: 2021-03-24 10:12:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: e58f3a697a11eef799adb2112c8e1213 SHA-1: b3f78e865b5d91b8421da81d1c1d0e6d8ed50ccf SHA-256: a2b890641fed66349e13d88a57ee4769b0d434abce0a4a2dd3ba8e24366ca58d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=importance+of+celebrity+endorsement+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4369149/normal_5fc6fc84d3c72.pdfIn PDF document text
    • https://cdn.sqhk.co/kofelejezem/joYJhjY/xedaselerogebu.pdfIn PDF document text
    • https://cdn.sqhk.co/mafowixodi/hcOzicA/how_do_you_get_followers_on_instagram_2020.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414169/normal_5ff20480e3f47.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426815/normal_6008d5a5c3f99.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476010/normal_60279dad200ef.pdfIn PDF document text
    • http://wamabivunufoteg.medianewsonline.com/brene_brown_boundaries.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470400/normal_6011c3847bbdf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408004/normal_6018e039b1e82.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sonutopexaramuf/que_es_manual_de_funciones_y_para_que_sirve.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e7eb1340-f0fe-4e2d-bfa4-1eacb9b923e4/the_wizard_always_wins_rules.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/384cb6fe-019f-4c80-9dce-3911b0234f39/30613088923.pdfIn PDF document text
    • https://s3.amazonaws.com/fekazudabo/vomufiwivamalimezo.pdfIn PDF document text
    • https://s3.amazonaws.com/tixedujegibex/gagejeboro.pdfIn PDF document text
    • http://tofilijewok.atwebpages.com/brown_v_board_of_education_1954_summary.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90d5fa66-deb7-4d83-952f-26628b323712/best_books_to_learn_android_development.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3615ded0-eb82-45c9-b774-f898d7869443/teruxopakakidakadekuvife.pdfIn PDF document text
    • https://s3.amazonaws.com/nonipesikiri/65328169268.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea81.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA81 5480 bytes
SHA-256: 1f013fa5ef127674b6339e0710ff10b8d09e5d2e568673a67399812783885d81
font_01_sfnt_off0000fd0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD0B 11004 bytes
SHA-256: 961cc977cd464a6eb519be377a33b2184106fad8e13c2405e64d3a9790eb888a

Open this report in the interactive analyzer, or submit your own file for analysis.