Malicious PDF — malware analysis report

Static analysis result for SHA-256 b202071b28737f4d…

MALICIOUS

PDF

99.2 KB Created: 2021-04-07 10:51:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 1e83cb29cf46954fddff903d048c6642 SHA-1: 7063a4d1115490a29b7fea5fda73ad65643abb91 SHA-256: b202071b28737f4decdbcb6f00ace34ed1b65fb369e313b0470b23fc909f2b41
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/123?utm_term=nfl+injury+report+week+2+2019 PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4420430/normal_5fdd5e6839af0.pdfIn PDF document text
    • https://sasexonitit.weebly.com/uploads/1/3/4/7/134757549/zebekapififin-luzebubawomuv-bivisixeduwaku.pdfIn PDF document text
    • http://teachersaid.fun/how_to_calculate_total_current_flow_in_a_circuitzuawy.pdfIn PDF document text
    • http://rerubin.space/9683172066ffick.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4379982/normal_5febe9fe62efb.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449622/normal_5fc9a6f9e2f9b.pdfIn PDF document text
    • https://tizelizenofus.weebly.com/uploads/1/3/0/7/130740364/mumupeluraleta.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496580/normal_60166f8a53ee2.pdfIn PDF document text
    • https://jotukodapoze.weebly.com/uploads/1/3/4/6/134632246/69384f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446017/normal_6064ed00240bb.pdfIn PDF document text
    • https://rinixupikexem.weebly.com/uploads/1/3/4/0/134096042/zigetirelazifi.pdfIn PDF document text
    • http://mscgis.net/74803164970lyxcv.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d48b6d25-9175-4f9e-a6db-13f6d45b844d/likelovosuragelomizenamo.pdfIn PDF document text
    • https://s3.amazonaws.com/sesafefanulokam/bacharelado_em_sistemas_de_informao_estacio.pdfIn PDF document text
    • https://s3.amazonaws.com/sepovutapakogaf/rumizitirojepapisimur.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78893f2b-08d5-4367-b074-6d10704a5554/65021585276.pdfIn PDF document text
    • http://nusorilafezevi.rf.gd/nikimuro.pdfIn PDF document text
    • https://s3.amazonaws.com/xidazeze/letod.pdfIn PDF document text
    • https://s3.amazonaws.com/kelukakeb/skyrim_how_to_fix_load_order.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76d60cb1-ecd1-493f-aca1-4a1c98a726f6/how_to_log_into_your_old_icloud_account.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4f60eab0-7c90-4a2b-8afb-a450ff96b7d2/troy_bilt_horse_log_splitter_attachment_for_sale.pdfIn PDF document text
    • http://kopedox.epizy.com/air_conditioning_system_nptel.pdfIn PDF document text
    • https://s3.amazonaws.com/pegozegi/jetezuxipexez.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013ff3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13FF3 5292 bytes
SHA-256: 94504913fb3a70f5a69fb0370a862ef00b9b7609d4ec29b44ab8af9ede3ed2b0
font_01_sfnt_off00015239.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15239 12980 bytes
SHA-256: 6f197afa396c1b929f4468c2ce448e146a12fa31f89ecb2a43724e3bef4de0ac

Open this report in the interactive analyzer, or submit your own file for analysis.