Malicious PDF — malware analysis report

Static analysis result for SHA-256 b60e18be50b30890…

MALICIOUS

PDF

73.6 KB Created: 2021-03-28 07:05:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 66f47d70cfd953d2f51e00dcfa335729 SHA-1: 521e27eb2ecd37bb4f7815f730d68f9f3f1a44d3 SHA-256: b60e18be50b3089007504465ff5ffdf35f34f6eddb41428f2db9c41a9dcf98d4
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/123?utm_term=court+reporter+courses+uk PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4403140/normal_5fc7a964b6644.pdfIn PDF document text
    • https://cdn.sqhk.co/merojuniv/jcphiSK/82848000077.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446942/normal_5fd17ddd438c6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4386848/normal_5fd03a38126f8.pdfIn PDF document text
    • https://cdn.sqhk.co/zejizoguzut/he4aqgh/bemasot.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/36382da2-40d6-4baa-9c70-fb516227ec87/how_to_open_an_armitron_watch.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33c219bc-2cde-46e7-8a4e-0b2a0fe65c05/kivomeragu.pdfIn PDF document text
    • https://777dd155-384c-4f1d-a337-8f27b94bb056.filesusr.com/ugd/1ecdae_e7778f4cb9e64edb97717f478c5e2cc3.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wudibirewuduto/82287120664.pdfIn PDF document text
    • https://s3.amazonaws.com/bulozor/76102959221.pdfIn PDF document text
    • https://s3.amazonaws.com/somisilegex/country_home_bed_sheets.pdfIn PDF document text
    • https://6ddb26ad-aa8e-4a3e-a925-5cef6fc035e1.filesusr.com/ugd/d3d820_a612ddffa184469e9e0fa462424b0659.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/juvetaso/wozuwomij.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/294698e2-27c3-49b2-8845-1f5de8fc56e1/kerapejeweralamedixi.pdfIn PDF document text
    • https://s3.amazonaws.com/sojuravewi/napanun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66497055-ba75-4723-beb0-204b04217ddd/webasto_heater_fault_codes.pdfIn PDF document text
    • https://s3.amazonaws.com/kotidox/vue_components_without_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c3d39c5-ea5c-4465-8e2d-b81057746dba/1960s_dc_comics_for_sale.pdfIn PDF document text
    • https://s3.amazonaws.com/fodose/ucmas_abacus_worksheets_for_level_1.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e24b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE24B 4656 bytes
SHA-256: 2b598ff658c297f2757721e7ff698b4b0e557ecbe81f5767ea1f78d49a14bdec
font_01_sfnt_off0000f232.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF232 11532 bytes
SHA-256: 572ed27f2220f562bc7df034c35ea0ccbac61bfb0729aecbff514006fdc1e937

Open this report in the interactive analyzer, or submit your own file for analysis.