Malicious PDF — malware analysis report

Static analysis result for SHA-256 addc5aaee0b82a17…

MALICIOUS

PDF

76.3 KB Created: 2021-05-21 22:05:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: eb12cb4840f16ac15711752b238b8554 SHA-1: dd25e597d9d2f7250697988d7e1a45330af24fd3 SHA-256: addc5aaee0b82a17a0802fa05c13d17ff22836121ee5955279089c01801c76b5
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ponafet.ru/strik?utm_term=3+ejemplos+de+monosacaridos+disacaridos PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4375358/normal_603c3040c7394.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458163/normal_601481447d84b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417643/normal_6012470a53065.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454682/normal_5fe0502caaf00.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386836/normal_6047a787252dc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369632/normal_606e188196119.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495413/normal_602ed60f49966.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470385/normal_5fd9c0b1c82bc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379733/normal_5fd6644266aa7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470040/normal_5fcf9fe4dab5b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xukirizugukugi/lugeb.pdfIn PDF document text
    • https://s3.amazonaws.com/dutimajizowa/99989911757.pdfIn PDF document text
    • https://s3.amazonaws.com/sitozi/amendments_in_indian_constitution_for_upsc.pdfIn PDF document text
    • https://s3.amazonaws.com/poguvelefa/23286428412.pdfIn PDF document text
    • https://s3.amazonaws.com/suximawo/jawar.pdfIn PDF document text
    • https://s3.amazonaws.com/laradusa/velafidenafax.pdfIn PDF document text
    • https://s3.amazonaws.com/wezukep/allen_carr_quit_smoking_amazon.pdfIn PDF document text
    • https://s3.amazonaws.com/jefazaxal/jabazuwobifikina.pdfIn PDF document text
    • https://s3.amazonaws.com/fidefofudi/96650787165.pdfIn PDF document text
    • https://s3.amazonaws.com/gumagabu/how_to_dress_for_a_day_of_the_dead_party.pdfIn PDF document text
    • https://s3.amazonaws.com/pujirageg/que_ocasiona_un_estilo_de_vida_sedentario.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9ED 5364 bytes
SHA-256: c500468d5a8cb4bc010a6090a13036d901c43023530db817458a47ed2d8ac4a0
font_01_sfnt_off0000fc0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC0F 11724 bytes
SHA-256: 8f2b7d63c9057c36e74c461885c009701821e99c142f3e78ba5a12aa5a1576a3

Open this report in the interactive analyzer, or submit your own file for analysis.