Malicious PDF — malware analysis report

Static analysis result for SHA-256 c26cc192e3affa80…

MALICIOUS

PDF

73.8 KB Created: 2021-06-05 19:42:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 80f7c50f4482df86902f49445847bdc3 SHA-1: e9dc2a2a8096f77d95cf8c2907ee227445128e71 SHA-256: c26cc192e3affa8052dfe216a1d7c2583d2ad15556cf15c6ca84b5b776fc5f6b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/123?utm_term=thinking+out+loud+piano+chords+sheet+music PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4411915/normal_5fdc4e952d1dd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375531/normal_60ba6ba7c61b4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4428069/normal_6021eca1a161d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379961/normal_60172061763d8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368951/normal_5fe4e385845fc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b3971348-b27f-4262-91ed-e22d255b2659/habits_of_the_heart_lyrics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/75675fe1-b198-41e2-90fb-e36f1f77e369/rejarepirofurowufunujib.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2102c9dd-6dc6-46a0-af4e-ea64ff3a6748/2005096710.pdfIn PDF document text
    • http://wenitudodub.pbworks.com/w/file/fetch/144626739/fill_in_the_missing_numbers_100-200.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e836ae9-d757-4d9d-8a92-5f8a78c8b541/fleck_5600sxt_parts_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a71aca6-b993-4338-a26b-46a882746572/bayesian_methods_for_data_analysis_third_edition.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b2973403-30f2-44df-a052-86415ee77a9f/75974154986.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24740f26-a7bf-4f2f-90ca-d5902bd7006a/popular_ballads_of_the_60s.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9042134-811e-41d7-b1c8-e13c8d2489a1/kenmore_70_pint_dehumidifier_with_pump.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60adb458-139c-401b-a241-0d9bbfc90620/how_to_apply_water_decals_on_nails.pdfIn PDF document text
    • http://pusavivo.pbworks.com/w/file/fetch/144476772/juxiwedakipipot.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e4efeb05-1f61-49d5-883c-da55e95035ff/surviving_mars_locations.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb686397-2d05-4174-8960-703e32570a08/zagatojezokisa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24bc6070-a504-43a3-b763-f0b368293e96/kasulibet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f401dc26-e712-45ca-b6d2-82229ad8e7b0/zisemonipipakosuwavu.pdfIn PDF document text
    • http://fulusivijomu.pbworks.com/w/file/fetch/144556923/xorijuwupafetabiwe.pdfIn PDF document text
    • http://nolumemonip.pbworks.com/w/file/fetch/144510501/jump-n-carry_jnc660_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e162.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE162 5500 bytes
SHA-256: 4ab0a19281584334d1b6e901daeb46820180b2d5a1ea56084d4c8a576a2eef0f
font_01_sfnt_off0000f3ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3ED 11056 bytes
SHA-256: d918d2f56c321f41a9c9fad6c88f1b7525a7aba7db77f8023b537bffc29d7b7d

Open this report in the interactive analyzer, or submit your own file for analysis.