Malicious PDF — malware analysis report

Static analysis result for SHA-256 aea6921e11d52f81…

MALICIOUS

PDF

64.8 KB Created: 2021-04-29 12:20:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: d4e8bc5e00344f316821f703cd2859d6 SHA-1: c3d2869c8697126f0a2c6b87d4778367400995d0 SHA-256: aea6921e11d52f81789d62bd5c535bb28af4f15f0417e8ead8c64cfbf1a8650c
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/strik?utm_term=what+shows+are+available+on+acorn+tv PDF link annotation
    • http://evatopshop.xyz/what_is_the_meaning_of_the_poem_howlbguh9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4373008/normal_5ffd6bb5ba7e3.pdfIn PDF document text
    • http://artdebug.site/vakerolozk3l94.pdfIn PDF document text
    • https://cdn.sqhk.co/lisupixiwe/l4hcLjg/93944747704.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495413/normal_600c57502ee77.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420775/normal_5fd2e08c4a65d.pdfIn PDF document text
    • http://bit7.top/toro_recycler_22_190cc_troubleshootinghxm9h.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419628/normal_6037388de7377.pdfIn PDF document text
    • https://cdn.sqhk.co/dexediwiboze/jajd4hj/govefidir.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450723/normal_6013027f71dab.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://8c805f22-5240-4a8e-9b4d-8499607ff1fc.filesusr.com/ugd/76156b_d9de4f9bfcca49759d1c0fdb7cb55103.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/regufojalojaza/nulemejewitiwag.pdfIn PDF document text
    • https://64f1e6a9-4530-4009-9f9b-67b91dd69f79.filesusr.com/ugd/76b6de_46bdce5a4a89402cb59f9e912e845986.pdf?index=trueIn PDF document text
    • https://f98f40d2-b649-4e6b-99af-b89bbf2331ff.filesusr.com/ugd/724bd4_79f10002002f4d1b9f16a826686986fc.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jedaxopopuko/facebook_videos_android.pdfIn PDF document text
    • https://s3.amazonaws.com/biwubeleba/gevav.pdfIn PDF document text
    • https://s3.amazonaws.com/lupuvogotog/32168258500.pdfIn PDF document text
    • https://s3.amazonaws.com/jadudusujuje/61051073930.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c2f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC2F3 5192 bytes
SHA-256: bb1c064815754794a549976f4c8c512bef4ee19e79161639bbbfc6c44751019b
font_01_sfnt_off0000d4b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD4B0 9792 bytes
SHA-256: 86d642369c70cb7ee0618288aaf4338bb8ea5c57fe5326ec3b984a87090ab0ac

Open this report in the interactive analyzer, or submit your own file for analysis.