Malicious PDF — malware analysis report

Static analysis result for SHA-256 ccd425d9271a3f08…

MALICIOUS

PDF

75.3 KB Created: 2021-03-14 15:24:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: b7b64962bd6f02639d5584f521df2960 SHA-1: b9061f42eccca8d032ca044f5223989deae62e34 SHA-256: ccd425d9271a3f082fa1acc489dad653a13e2622d68ac6729a174fe25e6f5015
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses an invoice-themed lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=accrual+basis+and+cash+basis+of+accounting+pdf PDF link annotation
    • http://kixiwogazu.sportsontheweb.net/filtrete_3m_thermostat_wifi.pdfIn PDF document text
    • http://xojuxelase.medianewsonline.com/47739818707.pdfIn PDF document text
    • https://cdn.sqhk.co/jemitaso/jdZQ2gi/64861005001.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4502567/normal_5fcce4875c1d3.pdfIn PDF document text
    • https://cdn.sqhk.co/juvebuzizej/poWjrie/56686463401.pdfIn PDF document text
    • https://cdn.sqhk.co/mekerijiwuv/ticia1N/zifekevatod.pdfIn PDF document text
    • http://rosutob.getenjoyment.net/vowebowogazibo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447631/normal_602bdc7f55255.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/marimejerebo/forapalasogiwurexeji.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/46afe69d-a889-47ed-a6ac-f08e89b00532/kenmore_oven_model_790_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/zurovajij/zesumunomugozotagezamujim.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/071a65a3-54fc-42ab-a817-ae0c28ffc95a/guziveremedox.pdfIn PDF document text
    • https://s3.amazonaws.com/kovezodepugov/expressions_and_equations_6th_grade_worksheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e354e5f-ae4a-4937-9200-857aada75598/39817509837.pdfIn PDF document text
    • https://s3.amazonaws.com/lemerisinivum/vuworana.pdfIn PDF document text
    • https://s3.amazonaws.com/wakuzidi/jixefusotodabewuluz.pdfIn PDF document text
    • https://s3.amazonaws.com/limepusotanal/vertebrate_and_invertebrate_worksheets_4th_grade.pdfIn PDF document text
    • http://sulorowanutabu.atwebpages.com/what_concealed_meaning_does_the_poem_fire_and_ice_depict.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0bde86e3-2eec-45cd-a7b0-2afeae475857/competencias_para_la_vida_nuevo_modelo_educativo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e90e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE90E 5544 bytes
SHA-256: 2065493cb5a6ea690a7b60b10286e16b589a2791c831fd72eb83073180e40395
font_01_sfnt_off0000fbe0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBE0 10600 bytes
SHA-256: 7c0b271c4b18739c6207ecd4be1fcf57cacf2a973634f42df6ff34eb9e044d27

Open this report in the interactive analyzer, or submit your own file for analysis.