Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2d4100a0b96c36b…

MALICIOUS

PDF

96.9 KB Created: 2021-05-08 10:28:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: ef4383bd90bb1d273703ce372dc78add SHA-1: 56f284396945b12714d8d01f84ece81118d1fc0a SHA-256: b2d4100a0b96c36b326cf9b8d03e29385bd6147d5aba8f2eca5ac0638fc6984c
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=what+is+the+ornish+reversal+diet PDF link annotation
    • https://cdn.sqhk.co/wupetutigo/Qjficie/fewen.pdfIn PDF document text
    • https://cdn.sqhk.co/rozesivotix/Ria3WNS/xomekebonododexejododagi.pdfIn PDF document text
    • https://cdn.sqhk.co/dowamagova/bVFChiw/arma_3_pc_game_highly_compressed.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/lovomijelun/91393906170.pdfIn PDF document text
    • https://s3.amazonaws.com/wegemebufojafak/edina_minnesota_police_reports.pdfIn PDF document text
    • https://s3.amazonaws.com/legapatatezisa/10570487609.pdfIn PDF document text
    • https://s3.amazonaws.com/mesixadelomomo/what_the_meme_game_walmart.pdfIn PDF document text
    • https://s3.amazonaws.com/sagotomagin/what_are_two_reasons_why_the_renaissance_began_in_italy.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dce5a4b3-c8d2-4ed3-b5fb-0acc651e2213/29857906931.pdfIn PDF document text
    • https://s3.amazonaws.com/genedesowul/nixipelojev.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0bd1764-c1d8-4649-b563-519858fdaed9/seamless_bible_study_youtube.pdfIn PDF document text
    • https://s3.amazonaws.com/furunumaroxun/antiderivative_of_cosx5.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/13d36682-86f1-477a-918a-a009e61434a0/why_is_my_whirlpool_washer_not_working.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e22a418-3870-4d88-8134-4ac1987bcfa8/vinuxulewigu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b974034-56be-44e9-a0e7-d5d7bba4297f/who_wrote_dr_bob_and_the_good_oldtimers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea15ea7c-82f1-41c0-bcf1-752483872807/sokogogelunezos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ca293fbd-a716-4155-8d9c-7afb86e3133b/what_does_the_expression_go_ask_alice_mean.pdfIn PDF document text
    • https://s3.amazonaws.com/tokatefozude/92173169795.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/306b0d03-9caa-41a5-afba-2ebe03aa960c/wubawetares.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7266ff51-0ca6-4276-8a1d-1fd114b4a723/dark_souls_2_best_boss_weapon_for_sorcerer.pdfIn PDF document text
    • https://s3.amazonaws.com/dazemi/bikixozuf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c4259da1-c75f-49dd-afb0-0ea1b2f9bda4/is_newsy_a_free_app.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df2b5478-691b-468e-97cb-2acfb53b14a7/graco_duetsoothe_baby_swing_and_rocker_sapphire.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001306f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1306F 4772 bytes
SHA-256: bf576e49b53031726a90c9dfa552a942c003d6e622c7a5cad4a1ff14d0273d3c
font_01_sfnt_off000140a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x140A6 11188 bytes
SHA-256: 8a3543ebcd364c4a1887c7bc709ac60c6bd75d0c6565fdb4d50e97cfff1346b4
font_02_sfnt_off00016697.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16697 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.