Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5434ec87c1a6e62…

MALICIOUS

PDF

79.6 KB Created: 2021-04-04 11:36:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 0a58286f5946eb2ae23649a2bd38e06d SHA-1: 11b0780ed6ec25883041e9ef3e1122c6b669fcfe SHA-256: a5434ec87c1a6e6200e92abe1128534ba5f28b8e7cb0cb74143173ae610d9087
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=vanilla+survival+minecraft+servers+bedrock PDF link annotation
    • http://lazadacostumercenter.com/charles_ssl_certificate_androida92jz.pdfIn PDF document text
    • http://world-wild-shop.com/piano_lessons_cost_near_meohw7c.pdfIn PDF document text
    • http://avlto.best/zumadagidufisokagobinij6w9hh.pdfIn PDF document text
    • http://parralax.net/what_child_is_this_chords_ukulelelybyc.pdfIn PDF document text
    • https://cdn.sqhk.co/gutinisiv/aQkihaq/xakepisovopazapanosaba.pdfIn PDF document text
    • http://thrivewebs.com/how_to_play_uno_family_card_gameezqlp.pdfIn PDF document text
    • https://cdn.sqhk.co/norifasil/ygfoicF/ckn_toys_car_hero_runs.pdfIn PDF document text
    • https://cdn.sqhk.co/vaxarogajib/qVgeYwy/runescape_raw_shark_price.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pekatikisuruki/movimiento_rectilineo_uniformemente_retardado_definicion.pdfIn PDF document text
    • https://s3.amazonaws.com/mogipegi/julien_marchal_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/bipepezuwed/fonunijejaxaz.pdfIn PDF document text
    • http://tigofed.rf.gd/history_of_muslim_scientists.pdfIn PDF document text
    • http://kolawevifo.epizy.com/bureaucracy_mises.pdfIn PDF document text
    • http://xiramubete.rf.gd/97849082471.pdfIn PDF document text
    • https://s3.amazonaws.com/dalava/sanexaregedazoxesume.pdfIn PDF document text
    • https://s3.amazonaws.com/potamotaz/76735331910.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20e6168f-2946-4fee-ab54-c017206ec22b/45277358843.pdfIn PDF document text
    • https://s3.amazonaws.com/pubopelej/raletizuse.pdfIn PDF document text
    • http://milemezubuli.epizy.com/metabolisme_vitamin_dan_mineral.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/941fdf43-89ba-4e3b-861a-20127a25b1ff/32209674000.pdfIn PDF document text
    • https://s3.amazonaws.com/zuniverijesud/huskee_24_in._two-stage_snow_blower_review.pdfIn PDF document text
    • https://s3.amazonaws.com/zufaxepixiguxax/40898397886.pdfIn PDF document text
    • https://s3.amazonaws.com/nawosineromigi/how_did_the_alliance_system_contribute_to_the_start_of_world_war_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3405f488-ec5c-4b39-afab-71d914352478/mass_effect_guide_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3cdf39a-4f9e-41f2-aa0b-9424dfb7479c/busifowifuw.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebd7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBD7 5396 bytes
SHA-256: e6d3fd2ff47b117de22ca2e26b4c6f1d8a2fa3695295d248f0d4c5ae38375b56
font_01_sfnt_off0000fe20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE20 2132 bytes
SHA-256: e94caa4fabf4f8fc1bf5be931f95f4703bfc9438bfef6285093b0679c4fa52d7
font_02_sfnt_off00010782.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10782 11528 bytes
SHA-256: cd9212fef7fd2d4160cac1b1a7ab14ad0f8ebd4a87056c6dd832126183286bc8

Open this report in the interactive analyzer, or submit your own file for analysis.