Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac29446eef41efec…

MALICIOUS

PDF

84.6 KB Created: 2021-05-22 21:46:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 040487f80b37657f27be1a994af7d036 SHA-1: 707d392429ad7b754be639883405cc8eab54d17a SHA-256: ac29446eef41efeccba53685e785322ff257e5b9833b3fbd6302ea662e3812f8
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=how+to+read+nashville+number+system PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4426954/normal_5fdfd95a349de.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4483833/normal_5ffa30a842c12.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426270/normal_6042c89d0b7fc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465400/normal_5fce8f7b49f43.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478685/normal_603cce7246183.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387918/normal_60272e8f14918.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384029/normal_6049450d58ee1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453914/normal_606aae8250e59.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4479460/normal_6047a920160be.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ef8f7eb6-d356-41e1-a479-41455d793f9c/possessive_adjectives_multiple_choice_test.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/493dafec-4136-47f7-abaa-8e985ea41d7f/41377374901.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a9f3539-79b9-43ba-bf99-0386c8d41e1c/el_escudero_de_dios_descargar.pdfIn PDF document text
    • https://s3.amazonaws.com/nowokil/81574451630.pdfIn PDF document text
    • https://s3.amazonaws.com/dosipive/lozitaxodefavu.pdfIn PDF document text
    • https://s3.amazonaws.com/zesotat/stihl_ms250_price_new.pdfIn PDF document text
    • https://s3.amazonaws.com/jeromopelurab/fotivajurovesewewemamox.pdfIn PDF document text
    • https://s3.amazonaws.com/robumuduluwise/mother_kundalini_guided_meditation.pdfIn PDF document text
    • https://s3.amazonaws.com/wutogugej/46333533437.pdfIn PDF document text
    • https://s3.amazonaws.com/sukedil/implosion_mod_apk_obb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/98148084-228f-41b8-988a-d639d0c70c33/lupukufotunivumulisoxeto.pdfIn PDF document text
    • https://s3.amazonaws.com/lurutopobi/romeo_and_juliet_movie_2013_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/bezutu/magic_chef_ice_maker_hnim27st_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f4b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4B5 5420 bytes
SHA-256: d4b01d2f5ae86b37db66ca098c039ce14bed112f68da374d0dad4f736f11fe3b
font_01_sfnt_off00010710.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10710 11316 bytes
SHA-256: de94e88655cce894e83693f426edb037ba81de0a0dd26e5ba77cfe73229333f9
font_02_sfnt_off00012e17.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12E17 16120 bytes
SHA-256: 184efd0e138a9418359f6897f9ac56b5cd93cafbd57abf30711ac2aee7e18832

Open this report in the interactive analyzer, or submit your own file for analysis.