Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6b4134d51bef3fb…

MALICIOUS

PDF

108.1 KB Created: 2021-04-03 07:00:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 4819ba579c5ab4b71fad4f4bc357bd78 SHA-1: 93c9ec6cee02666d9d360ab24e36dea49dac3cc8 SHA-256: b6b4134d51bef3fb3d5930f1d1cbcaa33409a48ba9aeb81ed8adfc33d1ac2a18
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/wix?keyword=amoeba+sisters+video+recap+mutations+updated+worksheet+answers PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4413108/normal_5ff032fe5deaa.pdfIn PDF document text
    • http://meblik.su/95354104082a1lch.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474448/normal_6039b3aabe2db.pdfIn PDF document text
    • http://vipmanmarket.space/97766788422si02q.pdfIn PDF document text
    • http://tersq.fun/piselazozukefomizaralufiwef8xi.pdfIn PDF document text
    • http://damvglaz0.xyz/read_alanna_the_first_adventure_onlifrg35.pdfIn PDF document text
    • http://kprovk.xyz/30595053111lvwko.pdfIn PDF document text
    • http://iclod.tech/musemebupmz29.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486365/normal_603721d55cd75.pdfIn PDF document text
    • http://nosinoski.shop/sofewumezagadelipijugs08g.pdfIn PDF document text
    • http://beautytopshop.site/fegelopahi4hs.pdfIn PDF document text
    • http://contact-git.top/colour_pencil_art_for_beginnersq4tur.pdfIn PDF document text
    • http://microbladingeyebrowsdallastx.com/netiradqob70.pdfIn PDF document text
    • http://excschool.ru/fillable_family_treehmd8m.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4499317/normal_5fde865c59f69.pdfIn PDF document text
    • http://olymp-trade.top/how_s_life_funny_answersk6ghz.pdfIn PDF document text
    • http://com-connexion.xyz/xozatolowezetonejegadimarwibd.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tuxalowafokuvo/sarl_bodler_albatros.pdfIn PDF document text
    • https://s3.amazonaws.com/mijumomub/1264699247.pdfIn PDF document text
    • https://s3.amazonaws.com/tometubufimopim/bhopal_city_road_map.pdfIn PDF document text
    • https://s3.amazonaws.com/fidefofudi/51254873862.pdfIn PDF document text
    • https://s3.amazonaws.com/temujonuwu/rabezerudapofeba.pdfIn PDF document text
    • https://s3.amazonaws.com/xoferuzu/what_are_mixed_service_costs.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015f9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15F9F 2828 bytes
SHA-256: a17885b4fd577e0298a64705d5055d2ac7c2363fd7008e9cf236b3df412a17d8
font_01_sfnt_off00016999.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16999 5628 bytes
SHA-256: f6ee02b256aa1289a92b6a0c13a710fc702b6ad96b1eec793b0367792707d8a6
font_02_sfnt_off00017c9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17C9E 10216 bytes
SHA-256: f037fac0f2f99391bd15f4584c56a7ef75ed290e0afc8de1af647ad3ee820b40

Open this report in the interactive analyzer, or submit your own file for analysis.