Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2bf5a6ac706f3a0…

MALICIOUS

PDF

85.3 KB Created: 2021-06-01 00:00:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 4c26c6b0b76a8fd03227d8b1d7785129 SHA-1: cd74de54634b33db755e69fe72a7ccc3712fbaca SHA-256: c2bf5a6ac706f3a004de385f667aa80d9c2a5442113f9a4f001e00a893008796
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/123?utm_term=history+of+video+games+timeline+worksheet PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4413110/normal_6056da235078c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447108/normal_600fa8198cf2f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3b9410f-e248-4086-ab42-cb59f40152ea/sorokisamedenobepo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8767f1aa-5a39-461f-a95c-93616177c0e5/6137647126.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2049a19-f9e7-4015-b2b0-aa0e8a552de5/tomipufupawupunilive.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/363a9b08-c81b-416b-8106-26fe141c2f35/netgear_dgn2200v2_bezeq.pdfIn PDF document text
    • http://bovojigu.pbworks.com/w/file/fetch/144420216/cuentos_cortos_de_aventuras_para_nios_de_secundaria.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa41fae2-91ae-4e63-bede-a93a705dd989/safe_auto_insurance_account_login.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8cfa180a-debf-4e2b-88e2-9ebf6e6bd689/60111150128.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e550360-f160-4fee-af2b-4f61a4e640c1/zmodo_nvr_8_channel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/034d14cd-e0c7-427f-b04e-e93b84469fca/leladize.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/009fd01b-2871-4610-8c2f-30d3f2083bb4/world_war_z_xbox_one_gameplay_coop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6da58c5f-9775-484f-9933-ecfeaf3f1b42/kexelumutewobubawaf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d442bc8d-4621-4e92-8609-b90431a9862e/rimegov.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80726121-51da-4e6d-9c1a-26d1422dae9e/jugos_naturales_para_bajar_de_peso_con_pina.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cd79033f-1a1e-4780-b0a1-9368f5fa0160/18564806209.pdfIn PDF document text
    • http://jajafad.pbworks.com/f/xirefipef.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f303ca2-f3f4-48bf-a6a0-5f0d788aed5a/baxawadovamijosis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5357674-4f1a-482c-90de-44e260bd5837/star_wars_knights_of_the_old_republic_2_timeline.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb101985-0711-4c9d-8769-3089d4ad0302/bipejokozu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06b9ccbf-0124-48e6-a7d0-1c3ddd84c92c/42574879321.pdfIn PDF document text
    • http://nilanom.pbworks.com/w/file/fetch/144416151/troubleshooting_scansnap_s1300i.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010c48.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C48 5600 bytes
SHA-256: db8f7f47671da409386bcdcd77e87780a65bc50d5f1ece5f64db198efbdf1781
font_01_sfnt_off00011f41.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F41 12448 bytes
SHA-256: 9417579054ccab74c8811c25b0429e9fbd173319d7eaa92f4aef3353a75ee00e

Open this report in the interactive analyzer, or submit your own file for analysis.