Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab77aedcc6e0a523…

MALICIOUS

PDF

85.5 KB Created: 2021-03-12 13:17:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: a6c5379000cfabbcd2d6ae82280bc01f SHA-1: 944ae363b323951cd62a0af57ded1c6d6fc4e23b SHA-256: ab77aedcc6e0a5230669b1856dfc561cc1f4986539a28d84f7823c1c319aa949
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9985

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/123?utm_term=cumulonimbus+cloud+formation+video PDF link annotation
    • http://faxadiweruxu.22web.org/poemas_de_amor_alfonsina_storni_libro.pdfIn PDF document text
    • http://idealicagocce.site/5198154753254hbv.pdfIn PDF document text
    • http://senuzuwaneju.22web.org/hp_pavilion_dv6000_price_in_india.pdfIn PDF document text
    • http://life-news.tech/30208043123vi9ae.pdfIn PDF document text
    • http://jabilevij.mypressonline.com/jinus.pdfIn PDF document text
    • http://jotitojimo.mygamesonline.org/open_source_bookmark_editor.pdfIn PDF document text
    • http://kesuvajeb.scienceontheweb.net/how_to_play_games_on_a_ti-34_calculator.pdfIn PDF document text
    • http://startbastar.online/24_gauge_aluminum_sheet_metalsb6ui.pdfIn PDF document text
    • http://lg-copyright.com/wamolamujexufilibixagegoza7orv.pdfIn PDF document text
    • http://boxberry-24.cc/is_diastasis_recti_bad_during_pregnancypzv2q.pdfIn PDF document text
    • http://xogunajeraxuda.mywebcommunity.org/radosupefibifulu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/zolerazowubow/lotemotawite.pdfIn PDF document text
    • https://s3.amazonaws.com/xisefowu/65510511431.pdfIn PDF document text
    • http://mawidinivetobi.myartsonline.com/mekonevosi.pdfIn PDF document text
    • https://s3.amazonaws.com/warapagefasovi/dd_2nd_edition_classes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47f805fa-3a9d-4c22-8252-127b5f6d0599/bezujaj.pdfIn PDF document text
    • https://s3.amazonaws.com/senodiw/vadematox.pdfIn PDF document text
    • https://s3.amazonaws.com/tarajix/14967300020.pdfIn PDF document text
    • https://s3.amazonaws.com/mokixetat/google_sheets_query_sum_two_columns.pdfIn PDF document text
    • https://s3.amazonaws.com/zazelujeju/chrome_free_apple.pdfIn PDF document text
    • https://s3.amazonaws.com/lakadutof/20738086825.pdfIn PDF document text
    • http://jokizexolej.epizy.com/47358403187.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f61a9f61-5c39-40de-bec0-7062952d9bce/11870843707.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f439.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF439 5272 bytes
SHA-256: 013b378916885d9490b18f1e0899e2ed2e64ac5726d10ee010dc06abe11a8b17
font_01_sfnt_off00010605.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10605 2896 bytes
SHA-256: 590346821c9c97c011ddd34c6d9069a92cca62f27141f8a3d48d4a83aeb33853
font_02_sfnt_off0001120f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1120F 11580 bytes
SHA-256: 6bfc1a9ffdb24766dc7741d2893b65df686c9e19ec5648d5b6540881f123dacf
font_03_sfnt_off000139ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x139AD 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.