Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae5d1fb1fcfd836e…

MALICIOUS

PDF

81.2 KB Created: 2021-06-12 04:13:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 64d700a7045b6adbfcd5b80fe8282270 SHA-1: 46948d60bea15138dcb9ee99a34dd7d89339514f SHA-256: ae5d1fb1fcfd836efc9825c2ee537927ce244fc8a44b224a6b46b6bbf0e07987
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/pbw?utm_term=ghd+sports+live+match+online PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4379859/normal_60073ae929d7e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4484641/normal_5fce96bb9a157.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4462376/normal_5fe1919218a9b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379485/normal_604b2ef4df706.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449990/normal_60c3e4b42ea4e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366015/normal_6016472badbbb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444630/normal_5fd8a19796c94.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481422/normal_606dc58e39ba3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365539/normal_5ff527a87e605.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380871/normal_60bf0335085f8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4428062/normal_60571af235e09.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/4871f74f-e1b6-436f-9bf9-a58610517dce/tuduzuwozobosujoren.pdfIn PDF document text
    • http://wejojixi.pbworks.com/f/88544417140.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8be58451-b778-40e6-b6b2-48323581e441/19478524627.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/daaff318-82ab-41a4-8840-7881dd9387bc/75258395368.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4d9c8f67-a407-4dfb-99ab-2a34bc7f1aa0/48690759500.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6612bd84-d47a-4be8-add4-dd623aaf333f/kojudeludivelafeduzukin.pdfIn PDF document text
    • http://pigedigasexu.pbworks.com/w/file/fetch/144573327/44269438089.pdfIn PDF document text
    • http://jesababa.pbworks.com/f/57051225860.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/752004f0-7faa-4990-8559-868edb914411/honeywell_hcm-6009_replacement_tank.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c75ac750-5f1d-4473-be05-2f68ff409272/38014957359.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a23e1ae-2a96-46cb-a121-53059187606f/tozofajevi.pdfIn PDF document text
    • http://vowujepojez.pbworks.com/w/file/fetch/144585237/9482647763.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e782eff5-beee-4afd-9b0f-1c82c3e0dcb7/john_deere_d170_deck_parts.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f014.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF014 5192 bytes
SHA-256: 0b6d28be515c24405ff644afd46cf4574167934afd13980c6ad52c9d445f47f8
font_01_sfnt_off00010197.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10197 11696 bytes
SHA-256: b46273f20e0c6212e7797805b3c22ccf2dbf518755efcd1836782d572c440425
font_02_sfnt_off0001291b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1291B 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.