Malicious PDF — malware analysis report

Static analysis result for SHA-256 be12ef5f41d98e80…

MALICIOUS

PDF

80.0 KB Created: 2021-03-16 15:44:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 6d4e5ea9af1e6d43089fe1cf189eecf7 SHA-1: 5cabb0306efedd4ccbd651c8470125e235002b60 SHA-256: be12ef5f41d98e8089420622df36ccb97809f8cffa9dd3824b4f1c03f70a2790
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=serum+protein+electrophoresis+patterns+pdf PDF link annotation
    • https://cdn.sqhk.co/gegatuzikat/X8xYshj/99481389727.pdfIn PDF document text
    • https://cdn.sqhk.co/lizoxazafofe/lMgjggK/49969377432.pdfIn PDF document text
    • https://cdn.sqhk.co/vipujitebiki/jihXgjc/bubble_hero_2_pc_game_free_download.pdfIn PDF document text
    • https://cdn.sqhk.co/wixexozesila/ZbvgdFZ/bike_racing_3d_mod_apk_android_1.pdfIn PDF document text
    • https://cdn.sqhk.co/wodegamido/hj7vbgj/gifasukofokukena.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/61e4f131-2c81-4253-a63e-a35371f679a4/67169644173.pdfIn PDF document text
    • https://s3.amazonaws.com/fikuvine/financial_ratio_analysis_template.pdfIn PDF document text
    • https://s3.amazonaws.com/gonasidupij/51297489185.pdfIn PDF document text
    • https://s3.amazonaws.com/sowirutelevolur/functional_areas_of_business.pdfIn PDF document text
    • https://s3.amazonaws.com/rebomedug/how_to_separate_an_element_from_a_compound.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/547edf07-577e-49f9-b5d0-65fb4f64349f/pekufakolozetesolonaj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a85fea9-621d-4a7b-ac13-91a8edb3e93a/bemufanifumaferekigodob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a754399a-55f9-4a84-9413-d2ed1fbe5b89/33048307771.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ff3b57fa-7dcf-41bd-9697-a3bad08e9e02/how_to_program_avaya_partner_18d_phone.pdfIn PDF document text
    • https://s3.amazonaws.com/pujirageg/vive_colombia_viaja_por_ella_tiquetes_baratos.pdfIn PDF document text
    • https://s3.amazonaws.com/muvazi/battle_royale_movie_in_telugu.pdfIn PDF document text
    • https://s3.amazonaws.com/fuzafuzeruwit/27301301575.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfb44ccd-9c9a-4a87-b95a-fbe652a52ffb/how_to_find_lint_trap_in_washing_machine.pdfIn PDF document text
    • https://s3.amazonaws.com/savukojubusum/gevaz.pdfIn PDF document text
    • https://s3.amazonaws.com/sazariwapa/the_origins_of_totalitarianism_table_of_contents.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6eb6dd40-0d8a-498c-8ebe-6596477768c9/vosezezifovofuwaxipan.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e58e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE58E 5500 bytes
SHA-256: fb0d11c991026ab511665a7e9112316ef34021b489efaecea71f554f2f7b3122
font_01_sfnt_off0000f812.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF812 10768 bytes
SHA-256: 037c7dbb4a7f8e47101971e201406eba99eb69b0389f27e19f4eac5f3069e658
font_02_sfnt_off00011cfa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11CFA 16204 bytes
SHA-256: 31aa257675234f953cb39254c73a0c002637764ec2691c470e0912636c3685cf

Open this report in the interactive analyzer, or submit your own file for analysis.