Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0247efef8f72197…

MALICIOUS

PDF

67.8 KB Created: 2020-12-18 00:58:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: e7edbcd62d1e415b33b3a54fed7d3990 SHA-1: 2087c8ec6e8de5cde66eb943797476a09d5cda4c SHA-256: b0247efef8f72197f475555e16d428c85460f8e37ec27fdd0b223b892634141c
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=neet+biology+chapter+wise+questions+pdf PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fce00145895864d89538150/t/5fcfb1763fa051062b535303/1607446907825/christmas_sweeper_free_match_3_puzzles.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97328942-f799-4291-9209-4506d3bb38d3/xivifetukaben.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc10b71bdb33045eec31c8e/t/5fc171802dd96f591825c3fd/1606513024132/8065352267.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc64fa9403f5353fdba673b/t/5fd6280213a48350e80af418/1607870467603/48408463088.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc12a0327a199023ab7046e/t/5fd0b04aab2d482295e438c6/1607512139427/dining_room_chairs_with_arms_covers.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2a2af7848ba205d23b5ba/t/5fc876fb43b29e7a5af69a38/1606973180272/pabexatapejivujoduximofak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/07d8017e-73ce-4706-a53d-a65af438fa01/devoziwexunijiz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd89c9ba-4a94-4f78-be94-dc1c92343318/modern_database_management_10th_edit.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0f6c4e5c7695ca99bf722/t/5fc2c5ddbc819f1cf43428af/1606600157503/46945052097.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf662feaf37e3b6493f06a/1606379055771/83454514825.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0ed11491241adc4815e5/1606225617285/38437409236.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c9da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC9DA 5848 bytes
SHA-256: dd74a252db032b13e8ab62ea9eb6dc92410b1f2bda4b652a8404cae811ea4d9a
font_01_sfnt_off0000ddd2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDD2 10748 bytes
SHA-256: f5e03ee5e5f7a691c9ae8f5921064f1fb343f61ae83aeed70a72b9867e1646b4

Open this report in the interactive analyzer, or submit your own file for analysis.