Malicious PDF — malware analysis report

Static analysis result for SHA-256 b30fa4fcf7548216…

MALICIOUS

PDF

100.0 KB Created: 2021-03-08 18:30:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 71b193247cc3b0b4cef12c39f4e1a88c SHA-1: dac62c8698c76e82f62bce9215449ad8f8f5a40d SHA-256: b30fa4fcf75482160f71fb21419d5f25189baaf8ccdf85ccba109eaf7f657967
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9986

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/123?utm_term=recuerdos+de+la+alhambra+guitar+sheet+music PDF link annotation
    • http://lesuxofozadize.mygamesonline.org/xigosebo.pdfIn PDF document text
    • http://sudilufib.getenjoyment.net/fufaronegon.pdfIn PDF document text
    • http://xesepoxobij.22web.org/dark_grey_colour_formal_shirt.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366032/normal_60308ce2b73ad.pdfIn PDF document text
    • http://vojemodipu.sportsontheweb.net/georgia_driving_test_answers.pdfIn PDF document text
    • http://nitapida.mywebcommunity.org/grimoire_meaning_in_arabic.pdfIn PDF document text
    • http://raxejudesezix.scienceontheweb.net/95028024956.pdfIn PDF document text
    • http://xufunuduxatene.iblogger.org/1477276505.pdfIn PDF document text
    • http://sinoxaju.mygamesonline.org/83812323499.pdfIn PDF document text
    • http://jovefupe.mywebcommunity.org/how_to_record_a_sales_on_account_in_quickbooks_online.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456372/normal_600abb81db9bd.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • http://fawogalupa.epizy.com/20674957966.pdfIn PDF document text
    • https://s3.amazonaws.com/jepinebawo/kurelogidavemeru.pdfIn PDF document text
    • http://dapunujunet.epizy.com/the_big_bamboozle_free_download.pdfIn PDF document text
    • https://s3.amazonaws.com/wulotugadag/titawajutiromakijubeno.pdfIn PDF document text
    • https://s3.amazonaws.com/jifedefujodu/how_to_use_product_rule_and_quotient_rule_together.pdfIn PDF document text
    • https://s3.amazonaws.com/fakuguvil/dukitole.pdfIn PDF document text
    • https://s3.amazonaws.com/lewuli/bajul.pdfIn PDF document text
    • http://jiwenufaxo.epizy.com/adobe_acrobat_reader_professional_9_free.pdfIn PDF document text
    • https://s3.amazonaws.com/gezetega/babyganics_dryer_sheets_lavender.pdfIn PDF document text
    • https://s3.amazonaws.com/fumiposamisur/free_loan_agreement_template_uk_word.pdfIn PDF document text
    • https://s3.amazonaws.com/fajeloninesitel/mailgun_api_template.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e9af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9AF 20312 bytes
SHA-256: 351390918ffa69fae6e4c543b739e1f49763a857f646364699c14a8c9e3ad792
font_01_sfnt_off00012484.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12484 5276 bytes
SHA-256: b1ee45b765c510df23085631c9a4862ef588ef69ac0cbbdae71012f1f049459e
font_02_sfnt_off00013671.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13671 11752 bytes
SHA-256: a28bd6fe11cf6d9a7d514169336185a1f0ae23d21ac0d2b90dcd22f24a1b2942
font_03_sfnt_off00015e2a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15E2A 16204 bytes
SHA-256: c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449
font_04_sfnt_off00017359.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17359 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.