Malicious PDF — malware analysis report

Static analysis result for SHA-256 b968efbde4ca13b5…

MALICIOUS

PDF

95.6 KB Created: 2021-04-23 08:52:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 0151b84f7f8ce31fdbd673281977a639 SHA-1: 9ec49a665efeadc579e350b692e67436974f039a SHA-256: b968efbde4ca13b5d0b5d0fc06f90d1279c819009e5fe3b33043b34be9ebd9f7
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/strik?utm_term=whirlpool+duet+sport+dryer+won%2527t+start PDF link annotation
    • https://cdn.sqhk.co/nerawotobiz/Vjjgfjc/56232506064.pdfIn PDF document text
    • https://cdn.sqhk.co/kozuvurop/Wm2rIgj/86507134960.pdfIn PDF document text
    • http://xteenware.online/autonomic_nervous_system_pharmacology_questions_and_answers7fyni.pdfIn PDF document text
    • https://cdn.sqhk.co/satidaruxami/ighpZ0k/movie_quiz_2018_with_answers_easyquizzy.pdfIn PDF document text
    • http://dehydratedoriginalgoodness.com/what_is_active_listening_in_psychology38q5y.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419820/normal_5fccba75382c1.pdfIn PDF document text
    • http://pomirkapa.site/why_do_most_change_initiatives_failwhlcl.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472221/normal_60666a27ee21a.pdfIn PDF document text
    • http://betmoy57.com/mechanics_of_materials_8th_edition_ferdinand_p._beerjr1ra.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486033/normal_5fefdea986e62.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pegek/weather_report_of_kolkata_in_october_2018.pdfIn PDF document text
    • https://s3.amazonaws.com/podawakumepewez/reading_comprehension_worksheets_year_4_australia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/476c6d60-76e1-415c-8233-2ac3eed918f6/faiths_of_eberron_3.5_ita.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/75723692-1f26-4988-b5a9-e37c131710cd/does_out_of_sight_out_of_mind_work.pdfIn PDF document text
    • https://s3.amazonaws.com/jevedijadiki/oral_radiology_principles_and_interpretation_8th_edition.pdfIn PDF document text
    • https://s3.amazonaws.com/woneketelak/hyperkalemia_guidelines_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/xafaxotaful/how_to_knit_socks_on_circular_needles_toe_up.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a3c54be7-c3b5-40d7-a99c-3f3977b54d5f/where_can_i_take_calligraphy_classes_near_me.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4073b46e-91df-4d02-82e4-715822bdda01/zanenob.pdfIn PDF document text
    • https://s3.amazonaws.com/jujadodedaruxix/jelly_roll_pan_and_a_cookie_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/bezegoluzose/omron_blood_pressure_cuff_hem-780.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000135ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x135EE 5288 bytes
SHA-256: 37319ef513ef759d245b6cca783c4612891207204a0c0f772b5bf15ca32a6caf
font_01_sfnt_off00014800.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14800 12064 bytes
SHA-256: 75cdc23bf00d87628b55fc6994979d710d3f7215fb55e9745ab0f1799290a606

Open this report in the interactive analyzer, or submit your own file for analysis.