Malicious PDF — malware analysis report

Static analysis result for SHA-256 aaf20963c514f2d3…

MALICIOUS

PDF

77.0 KB Created: 2021-03-16 11:13:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 186fa4415672f0fefd9de52fe0e36f6c SHA-1: afa98299da6781b55bb73b5c3a6dca2fca1f0386 SHA-256: aaf20963c514f2d3581b055f6c2f9d07950990cf5e443fa3b8cb651f4b175a32
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=what+is+convolution+theorem+in+signals+and+system PDF link annotation
    • http://xaxifibipebux.iblogger.org/59121649633.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4382643/normal_5ff1beae1653a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450415/normal_5feb74b962b30.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501810/normal_5fdaf0a14010b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413227/normal_6011efedb887e.pdfIn PDF document text
    • http://storeplus.info/la_antigua_biblioteca_de_alejandriaoczy0.pdfIn PDF document text
    • http://mexuloxuxinona.iblogger.org/bereavement_leave_ireland_citizens_information.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465149/normal_602fd3e0ab1e4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4452206/normal_5fde2e4529ecb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368742/normal_60268bbe4185e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369185/normal_600e5a153a3af.pdfIn PDF document text
    • https://cdn.sqhk.co/derixosu/iJpifgh/30379192551.pdfIn PDF document text
    • http://consumer-data-protection-bureau.com/wagased0xzo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4487618/normal_602baa23c938a.pdfIn PDF document text
    • https://cdn.sqhk.co/mizipudi/QFIgjie/14423902191.pdfIn PDF document text
    • http://legalvictory.group/43616535775eeo7y.pdfIn PDF document text
    • https://cdn.sqhk.co/wevexifimur/gchiCWU/green_forest_hd_images.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://vepasojus.epizy.com/boborulaxepibep.pdfIn PDF document text
    • https://s3.amazonaws.com/pidufozu/how_to_change_background_color_of_the_photo.pdfIn PDF document text
    • https://s3.amazonaws.com/voxazedisula/41759586706.pdfIn PDF document text
    • https://s3.amazonaws.com/jidagafinuxesu/how_to_disassemble_hp_pavilion_g_series_laptop.pdfIn PDF document text
    • https://s3.amazonaws.com/retobifulipo/fikeleniluzivu.pdfIn PDF document text
    • https://s3.amazonaws.com/sewamos/31196613516.pdfIn PDF document text
    • http://mijunuwe.epizy.com/mupudajolad.pdfIn PDF document text
    • http://medazigudid.epizy.com/cursive_writing_a_to_z_capital_and_small_letters.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea27.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA27 5528 bytes
SHA-256: 26afd6ba9c2bfe9e5311e8ae16ca4baaf15a2f968b09e1733f043cde81543e01
font_01_sfnt_off0000fcda.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCDA 11412 bytes
SHA-256: 48a470062e22da99453fc0a7347e00e665427c9c0dfadb79de5c50925f2fd51a

Open this report in the interactive analyzer, or submit your own file for analysis.