Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8bfc342084d4f3e…

MALICIOUS

PDF

79.1 KB Created: 2021-03-31 20:17:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 46eda4b2f38284ec6c963fbc33741ac6 SHA-1: 896bd8925ec66ff9ebfc20f36037c66a244438a9 SHA-256: a8bfc342084d4f3e970c694257fe05cc494631abb82cff9b94b1a9011ffb06d6
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=oriflame+catalogue+february+2020+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4379491/normal_5fdecd308b0a3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414869/normal_5fe01062c71f1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427504/normal_6014489714321.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462986/normal_60184b8808425.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489992/normal_604aa14fc6223.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366628/normal_602c4b61bd805.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450884/normal_6048dca8d2a57.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392220/normal_601b87306f82b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec1c8725-90b8-4468-90e8-d9bb211b99c9/robajalomoj.pdfIn PDF document text
    • https://s3.amazonaws.com/fibesezati/73321908013.pdfIn PDF document text
    • http://pabomajemoxu.rf.gd/cfa_level_1_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce7de00a-d341-42f3-8c87-2e38d0e96fb4/romeo_and_juliet_act_1_scene_4_explanation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5751fb87-97cb-436f-aaf5-55d810889ef4/golf_buddy_watch_wt3.pdfIn PDF document text
    • https://s3.amazonaws.com/zoromexemuzid/92954754076.pdfIn PDF document text
    • http://devugagevubuz.rf.gd/baixar_whatsapp_para_android_2._2._2.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/256196ac-30b0-4048-812b-ca500b4ef144/46467798583.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e8728485-7ee5-4c5d-bdb0-3cac97cd50ec/what_is_sarah_from_dance_moms_doing_now.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF7C 3616 bytes
SHA-256: 15ac634e07e86a546e6ded9a7d67178cd309dbe6e0b7c6bc737a86a36eab533b
font_01_sfnt_off0000ec83.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC83 5840 bytes
SHA-256: d7fb62c05af048dfa5f45f20be263bb370baee3cf8ae59efe2a35eb411b17422
font_02_sfnt_off00010047.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10047 2116 bytes
SHA-256: 991f7ef292b59849fa1804c361c52a6255426db797fbcab3b5d31d1f34ee76c9
font_03_sfnt_off000109f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109F2 10732 bytes
SHA-256: 4efc5fc9243531dcd5c4c575ea4540364ff41aff82fb71b60f02ac65730731b8

Open this report in the interactive analyzer, or submit your own file for analysis.