Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4e6ff11b17f2d5b…

MALICIOUS

PDF

76.3 KB Created: 2021-06-09 01:55:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 2dc86434cf7269aed3bbe7c6bb83b0d3 SHA-1: 2c9434e058d373b247acca893c03c1ee3b6801a2 SHA-256: c4e6ff11b17f2d5b287f961794a03d1d20c9ed40e33142c35bf5265343fd6374
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://chcial.ru/pbw?utm_term=jaanwar+film+mp3+song+download PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4427783/normal_5fe420edd6039.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468823/normal_6025b7650daae.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4466379/normal_5ff1cd62bb6da.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4473903/normal_602b0ec4d3ec3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4473030/normal_5fe0246abc1c1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370078/normal_5fca9ae3d576a.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4414491/normal_60b6b2d960328.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/acc28905-62e2-4574-a26a-0f6c0df1b636/nejuxakusorip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6abc3a28-c09f-4ce2-b361-7e9358b64e86/descargar_ciencias_naturales_3_primaria_santillana.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d3f0a39-5a12-4516-8549-92d5e9149f38/how_do_i_search_the_dawes_rolls.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/16141447-24e3-46dd-b0d3-baa2d4fb21aa/how_to_get_minecraft_on_ps_vita_for_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/adbc1b1d-f6e8-4261-ab04-a4636e58a719/kiwobatawusu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9498475a-96ee-420c-8e1a-a244efbfbd70/use_of_since_and_for_in_present_perfect_continuous_tense_in_urdu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6f5d729c-d2c2-487d-b697-62af6263fbb1/sermones_adventistas_del_septimo_dia_en_vivo.pdfIn PDF document text
    • http://wuvebag.pbworks.com/f/how_to_get_my_w2_from_my_last_job.pdfIn PDF document text
    • http://ronuzexem.pbworks.com/f/jakasofasuvifilajeroj.pdfIn PDF document text
    • http://wibajeku.pbworks.com/f/94666990924.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/705b089a-6f30-4620-bce4-8ecaa8ef9b87/gakada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7cf6b32f-f2ea-4c27-b57f-5a2412c8bd78/fakuzebobupo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc5462be-cc75-4352-a537-87905dfe69dc/how_to_access_my_navy_assignment_from_home.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC18 5604 bytes
SHA-256: 21d2af97ac3e1542bcd9f4da375a9f7589c862bcac604bc5828915147198be9f
font_01_sfnt_off0000ff28.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF28 10960 bytes
SHA-256: 2e838dc9027199bb05416360f64fa694db9c58fef0d76f397930b3894bf7ba5a

Open this report in the interactive analyzer, or submit your own file for analysis.