Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbd08cd9ebb07026…

MALICIOUS

PDF

76.7 KB Created: 2021-04-04 05:45:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 136fc3cb602def37497426be4fa133c4 SHA-1: b82188aed2f1214373069fbfb0a15ca66635906a SHA-256: bbd08cd9ebb070261c7e17a1229db7e060ddd65983a1ce19db546c7377f18b69
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=forbes+travel+guide+hotel+service+standards PDF link annotation
    • https://cdn.sqhk.co/xavonepez/lBjiJDB/9830737899.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380700/normal_601bda20dc592.pdfIn PDF document text
    • https://cdn.sqhk.co/jozanafe/ihgihgg/mozedura.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456369/normal_60265c0fd8c4f.pdfIn PDF document text
    • https://cdn.sqhk.co/jawuraxexije/iILjjhi/juvefumawasowi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368964/normal_60250745ef75d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4473322/normal_5fe278bad57c3.pdfIn PDF document text
    • https://cdn.sqhk.co/rejelozekazo/gigiBzv/48398539404.pdfIn PDF document text
    • https://cdn.sqhk.co/tajudozizif/jhcheaK/nifalasasujozaba.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/bfe19526-d56d-4d83-bea0-ece16e078624/problems_with_samsung_dishwasher_dw80f600uts.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31bea73f-ec5b-4197-b48c-31df70092936/motinigaxifiru.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/599a81f3-c3be-4788-a9c9-f89a4036b980/gonuf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5abb7501-b2f3-47b8-97c6-46857e687bd8/which_native_american_group_lived_in_wigwams_and_longhouses.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df8d0b57-dfe9-4769-85b3-17f3ee34e45d/cause_and_effect_of_the_russian_revolution_worksheet_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/defipedibe/putis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4aee1433-8e25-413d-a135-98ca07b4b617/what_are_latin_maxims.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/706f408d-4b16-4ef1-a4c1-143771c39e1d/moto_g_3rd_generation_battery_price.pdfIn PDF document text
    • https://s3.amazonaws.com/bokofapig/plantronics_m50_bluetooth.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a32a4f6-c0df-4c32-a4dc-79e43b381d70/navy_bmr_sign_up.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a70fea49-e7b1-4eb3-a9a6-ca14182d497c/rixefizisutu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73075b6e-5e25-404b-969f-cdadc3d42c1c/verbal_advantage_download.pdfIn PDF document text
    • https://s3.amazonaws.com/xewamejixolefaj/japak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fac94e7-9255-4391-bda3-0945b32e0fb4/tekum.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/edf87118-1b8c-48cc-9ce7-3048b994bfee/53622418281.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee37.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE37 5356 bytes
SHA-256: 88981b736ed37f9a5e7c24b92c9f446341090d70018dd4a5b8cecc1d4aca6614
font_01_sfnt_off0001006b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1006B 10868 bytes
SHA-256: acd5ee97fce627d4efbe35598839ab2b7d0b6a0b81613abe3d787ae35e0823fb

Open this report in the interactive analyzer, or submit your own file for analysis.