Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8967674303b843e…

MALICIOUS

PDF

80.2 KB Created: 2020-11-20 07:47:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02
MD5: 2328de403c0a16ecbb9558b1fe7d20df SHA-1: d368c1a54ddc52c2b9a67c0022daa970828df9b1 SHA-256: a8967674303b843e18dc5ee8c3cc5fe96f51783d6c0e7ee90125227cd868dcdc
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=headband+of+mental+prowess PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4427077/normal_5fa34ae483d0b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389101/normal_5f971e1b276df.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367297/normal_5f89d42b8ad79.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417675/normal_5f9cd8ca96f8e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pazovugal/zejoja.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53842183-78c0-4b54-bc69-e6e50bb8a2b1/jipupasedak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60cf789f-945b-41e8-8708-afbf2908d978/list_of_scholarships_2020.pdfIn PDF document text
    • https://s3.amazonaws.com/xamapebonijos/respond_and_acclaim_2017.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e474a087-5fd1-40a1-8a89-316a572f9109/hayward_aqualogic_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/jadere/the_lightning_is_a_yellow_fork_summary.pdfIn PDF document text
    • https://s3.amazonaws.com/tobobowu/diwokogolerufitukagaduz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/29e70665-6177-4303-86b0-e291258b8d62/39255151389.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d828fa87-f982-42cb-aa15-3fdee3faf750/zuwafajivizewufesufa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe10.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE10 5380 bytes
SHA-256: 9748e1e4347a64b41bb313a2bb7342b9c4ee7d49a298e52bbf3c998fc07076c6
font_01_sfnt_off0001104f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1104F 10748 bytes
SHA-256: 0438b78b2a34cab204a91454462cc2dbb155135fdc7aae3bc9b5d6021cede8e8

Open this report in the interactive analyzer, or submit your own file for analysis.