Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc0a568bd33b60a1…

MALICIOUS

PDF

76.2 KB Created: 2021-04-14 02:47:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: f5938b5b4d1ac0fdc22da453143f82a4 SHA-1: d776ab6fdd502066d0724cfe8308f1e27e53f993 SHA-256: cc0a568bd33b60a1522c5b04b17d360f2b00f56e78f6acf423148bdd28063675
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a remote-support lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=roles+and+functions+of+social+work+administration PDF link annotation
    • https://cdn.sqhk.co/retobumoki/iojffhc/3d_printer_cnc_laser_kickstarter.pdfIn PDF document text
    • https://cdn.sqhk.co/zapimafe/gc1jfgi/gijadolilepajubazorus.pdfIn PDF document text
    • http://nuwevabufa.mypressonline.com/ethical_and_legal_issues_in_business_communication.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480732/normal_60591b91b2784.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375507/normal_6047cd271367c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471082/normal_5fe9fecc1f781.pdfIn PDF document text
    • https://cdn.sqhk.co/bapuwanuvadi/12rigSG/35359727904.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416319/normal_5fcc5b3d7575b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377379/normal_5fedf4cab9359.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370987/normal_5fd12e63348c8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496816/normal_60690aaea70b6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446035/normal_600658b8191ae.pdfIn PDF document text
    • https://cdn.sqhk.co/sixerusesebu/fgcicNj/women_s_clothing_thrift_stores_near_me.pdfIn PDF document text
    • https://cdn.sqhk.co/guviterolovu/cjaShhu/frequently_asked_questions_document_template.pdfIn PDF document text
    • http://ravovenovibu.medianewsonline.com/95479962414.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487201/normal_600044459ab66.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470029/normal_6058cbeb201f9.pdfIn PDF document text
    • https://cdn.sqhk.co/xolovagi/O4gejfA/text_message_stickers_android.pdfIn PDF document text
    • http://lorakuze.sportsontheweb.net/xadopuwaleba.pdfIn PDF document text
    • https://cdn.sqhk.co/tesikotuk/YUhhPhc/etrade_pro_vs_power_etrade.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390638/normal_6049c12b930e5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378846/normal_600abfb8e1774.pdfIn PDF document text
    • https://cdn.sqhk.co/waxobakal/hibghhb/splashtop_download_streamer.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC54 5332 bytes
SHA-256: ea84fa0a795b0ae6ec4dffcc273ec008e2f78134a413d13db146dee92774cc4b
font_01_sfnt_off0000fe7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE7C 10708 bytes
SHA-256: 67b58dd5bc3704b95201713c342a442e561f849405ae9e674477272e0781a904

Open this report in the interactive analyzer, or submit your own file for analysis.