Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7e68dd2c50306ee…

MALICIOUS

PDF

73.5 KB Created: 2021-03-17 14:31:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 916d956f0fa052eda07e578c8708b903 SHA-1: 159cf9420215931c2da797069c3ab01dc5fc8ead SHA-256: b7e68dd2c50306eeef74bf2d43ae48a5079b0108164289eb9f2c00f45e1beae6
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/wix?keyword=living+language+french+advanced+pdf PDF link annotation
    • https://cdn.sqhk.co/nobukomorur/jcid2ei/simple_systematic_literature_review_steps.pdfIn PDF document text
    • https://cdn.sqhk.co/muvotugi/jiCifTB/10967842059.pdfIn PDF document text
    • https://cdn.sqhk.co/borefigux/jh6ibR5/ncg_theater_grand_blanc_michigan.pdfIn PDF document text
    • https://cdn.sqhk.co/ralapogifur/ienJSQJ/66477294654.pdfIn PDF document text
    • https://cdn.sqhk.co/wevamerazo/bhgi2Aw/25590286920.pdfIn PDF document text
    • https://cdn.sqhk.co/kipafipigifi/jalhdsW/jelly_filled_cookies_walmart.pdfIn PDF document text
    • https://cdn.sqhk.co/giwitosak/NxhcQii/41184250484.pdfIn PDF document text
    • https://cdn.sqhk.co/telivagawu/jk0gfge/kukigotorefogijikemenim.pdfIn PDF document text
    • https://cdn.sqhk.co/kedezoge/d3ghdHh/scariest_vr_games_ps4_2019.pdfIn PDF document text
    • https://cdn.sqhk.co/ximegawaso/foQhdEx/65390664373.pdfIn PDF document text
    • https://cdn.sqhk.co/baluwofuk/igSrrjb/mobojozutowoganazisat.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/midaguvimabof/ruxonokod.pdfIn PDF document text
    • https://s3.amazonaws.com/musoxifuvitalo/89048937327.pdfIn PDF document text
    • https://s3.amazonaws.com/jovekus/xovunulasimixevazajul.pdfIn PDF document text
    • https://s3.amazonaws.com/donarepemi/33088222116.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38ca95af-4eda-4973-b60d-62fe35112c36/the_vegetarian_han_kang_review.pdfIn PDF document text
    • https://s3.amazonaws.com/lanubili/brush_pencil_adobe_illustrator.pdfIn PDF document text
    • https://s3.amazonaws.com/nafibanefexex/lamakanazasimo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f12af5f-eae8-4180-83e2-72011e071246/zojojamomuketenufari.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b936c795-12cd-4ace-8a89-cb06ed879aa7/a_streetcar_named_desire_scene_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f4c9c9c5-4cc1-4f46-88e7-47f5d328f171/2006_honda_civic_service_code_a14.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d22a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD22A 4932 bytes
SHA-256: 2892b503a2f08d988605bb672988b2f43e787edf196499eee235aad73b10dc48
font_01_sfnt_off0000e2e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2E7 11248 bytes
SHA-256: 62b8896f7398e74c0b213a08d196b496563ac42d92a8247fc8e4303da030b515
font_02_sfnt_off00010917.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10917 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.