Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5314efd48ab103c…

MALICIOUS

PDF

72.7 KB Created: 2021-05-31 16:25:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 255af38e7f915091e3f91005be46b386 SHA-1: 6c17e0417741b34bc69b6feae97ceeaf04311eb0 SHA-256: a5314efd48ab103cd612ca474758846a14054fee03102547cb2e7b251b22b361
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ketchas.ru/pbw?utm_term=sonido+del+shofar+descargar+gratis PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4408479/normal_5feba66fede8d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446789/normal_5ff39caedce51.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468571/normal_6046ccf65f767.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4497110/normal_606a370fbe2e9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4456166/normal_5ff3ea43536a0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4379363/normal_5ff5ec2346c86.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405674/normal_5ff003a3f415e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387816/normal_60518f5ed7c4a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367624/normal_6012e008d6060.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://xoxafepapesu.pbworks.com/w/file/fetch/144412134/99793606974.pdfIn PDF document text
    • http://sizolasipape.pbworks.com/f/mole_to_mole_ratio_practice_worksheet_answers.pdfIn PDF document text
    • http://jajisaparev.pbworks.com/w/file/fetch/144411978/mugurabilasasiw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/934c6b25-13cd-4d3e-b12d-2b8e96d703d1/shatter_meaning_in_urdu_language.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6d80f02-8470-46c8-9dde-8d3712d992ba/garmin_gtn_750_trainer_lite.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dadc4dc3-1f2b-43f1-99b3-adf1a979a861/23306820490.pdfIn PDF document text
    • http://xojifot.pbworks.com/f/49219219142.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df18f956-dda3-460b-82f4-5f0aff320e6f/balance_de_energa_con_reaccin_qumica_ejercicios_resueltos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fe40492b-c302-414c-ab1c-05bcb6afdd0e/how_to_program_genie_remote_to_receiver.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/102ceeb3-1a25-4ade-859c-dc5229f3ac1f/wikuvuperi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dba1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDBA1 5384 bytes
SHA-256: e7203ec976b71e7d2deae1a7360d4ed869f0eb9f81c51947711ea2a569ec3f18
font_01_sfnt_off0000ede9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDE9 12096 bytes
SHA-256: aa0543bd0c5d81df0e1eabe705f8ed3e53868f150738faf8f33acc8eb1567532

Open this report in the interactive analyzer, or submit your own file for analysis.