Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1f16da2659b2a31…

MALICIOUS

PDF

71.6 KB Created: 2021-04-03 14:15:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 85a9ad7f4095bab3313e7499391883d4 SHA-1: 27d35cb991ada13f9d9d1a8c55ae2375d991b5c4 SHA-256: c1f16da2659b2a310b82a5510d9916920a57a3f49294f37e4de7ce8f0793f6b6
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/123?utm_term=anita+blake+27+pdf PDF link annotation
    • https://cdn.sqhk.co/bedimiwojam/hdiTFgc/manual_for_whirlpool_refrigerator_gz25fsrxyy.pdfIn PDF document text
    • https://cdn.sqhk.co/kinanunir/ehjiePo/99964883281.pdfIn PDF document text
    • https://cdn.sqhk.co/lawipavoso/89jjDhc/77033805531.pdfIn PDF document text
    • https://cdn.sqhk.co/pajugeluj/euLjd1o/romantic_mashup_songs_2019_mp3_free_download.pdfIn PDF document text
    • http://majelogajizivo.iblogger.org/konarojatob.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450037/normal_6062d2af1b459.pdfIn PDF document text
    • https://cdn.sqhk.co/kibutonap/E3jjmWK/coda_definition_literature.pdfIn PDF document text
    • https://cdn.sqhk.co/guwiwugomo/mZfmzTn/denakofixuzizix.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485313/normal_6041cc856a747.pdfIn PDF document text
    • https://cdn.sqhk.co/wujakegu/e0aygfB/marvel_superhero_trivia_questions_and_answers.pdfIn PDF document text
    • https://cdn.sqhk.co/zowonefaso/yibgehi/38072526517.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4425916/normal_5fd76ecc5ee92.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wotodedaruzuk/39775840299.pdfIn PDF document text
    • https://s3.amazonaws.com/garorowa/96767413654.pdfIn PDF document text
    • https://s3.amazonaws.com/xirixepo/ziligokamivaxabe.pdfIn PDF document text
    • http://muwutumob.epizy.com/52135570110.pdfIn PDF document text
    • http://felixoxajaxev.epizy.com/balance_sheet_analysis_ratios.pdfIn PDF document text
    • https://s3.amazonaws.com/lomuper/coreldraw_x8_full_version_free.pdfIn PDF document text
    • https://s3.amazonaws.com/nemafu/birkat_hamazon_sefarad.pdfIn PDF document text
    • https://s3.amazonaws.com/zafaronivaj/akinator_apk_full_espaol.pdfIn PDF document text
    • https://s3.amazonaws.com/pusori/biology_textbook_for_java_phone.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dc13.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC13 5164 bytes
SHA-256: 0abb9abc77ca2dcafe80b53ae2230cfe12b40e050eb6447fddc8b029e6aebad8
font_01_sfnt_off0000edc6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDC6 10572 bytes
SHA-256: 66315974af9e8d1aae453d2b4e45b69d05d71c0730a888631430f72bdb6adb07

Open this report in the interactive analyzer, or submit your own file for analysis.