Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc6ae80132997af0…

MALICIOUS

PDF

85.1 KB Created: 2021-03-30 19:23:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: f9a6a483005d3e478914a3990ae27acc SHA-1: 549ba3c97f1172528145057ada2c12f7084375a2 SHA-256: cc6ae80132997af0908bf051898e452c5d4cfb0b2b92d249015c1e57fe3360d8
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/123?utm_term=assistive+touch+for+android+apk+mirror PDF link annotation
    • https://cdn.sqhk.co/xadeviro/whfgce6/dunowemukilafoj.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405662/normal_5fce408a48155.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386361/normal_6050cc8b5853f.pdfIn PDF document text
    • http://dejivuxa.mygamesonline.org/58674851515.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415934/normal_6016211c488a2.pdfIn PDF document text
    • https://cdn.sqhk.co/zizaratijiga/loggCGA/19198307590.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454303/normal_6031f1fe4e659.pdfIn PDF document text
    • https://cdn.sqhk.co/nexoratuxi/jjYgepU/xitopamuwidomuzisawi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413475/normal_6018da392f6c1.pdfIn PDF document text
    • http://gozimudowojuzun.mypressonline.com/uniformly_accelerated_motion_problems_with_solution.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368485/normal_601b472673010.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475212/normal_6025ee8a65da7.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4379611/normal_5ff30b39c5513.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370092/normal_601700020ff91.pdfIn PDF document text
    • https://cdn.sqhk.co/bepasasa/ZsgfPMm/94833943157.pdfIn PDF document text
    • https://cdn.sqhk.co/zojixemem/iiVjdje/36591985230.pdfIn PDF document text
    • https://cdn.sqhk.co/fiwujumejuf/wighhXa/zexasuti.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2011d9d1-8e89-499f-8ab7-4b92aa36dfed/evaluative_reading_comprehension_test_for_grade_7.pdfIn PDF document text
    • http://kifesafijupesob.onlinewebshop.net/96774609222.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b03a613-feaa-4506-9cfa-60c0cd658489/3614142337.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06847002-cf90-424e-873b-6896a21c9776/horseheads_elks_club.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00011a94.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11A94 24040 bytes
SHA-256: b4cd404202a8608ee9c72f6a4c1e915b6bcfafa52d55ccf60b350c19ab45daee
font_00_sfnt_off0000e3d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3D2 5476 bytes
SHA-256: d0297e8528133fe19880f16d4acee88176042b13ad62f8d3b49dbe1f95a46623
font_01_sfnt_off0000f65a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF65A 10464 bytes
SHA-256: 263f44a568422ac946d337a7cd7b1fac03b0f6cedc4229e2e0c2726a6da8cceb

Open this report in the interactive analyzer, or submit your own file for analysis.