Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd6b959ab1735151…

MALICIOUS

PDF

81.6 KB Created: 2021-04-03 19:31:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 123fae51f5afbe13e23728067514e3f8 SHA-1: 57e0fe345e314b719b0cc2f3a421e6c0e606d4a3 SHA-256: cd6b959ab17351511dc9530d3bb9ed4885cb71a714e65f884c0e7393025ff7ca
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=playhome+hf+patch PDF link annotation
    • http://lewijufe.sportsontheweb.net/literacy_meaning.pdfIn PDF document text
    • https://jetapixivokob.weebly.com/uploads/1/3/4/7/134726526/xelulomepaboj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393485/normal_60460f6c76cb5.pdfIn PDF document text
    • http://gedirobidepud.scienceontheweb.net/71701108276.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370791/normal_5fce2b09dfbfb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369766/normal_600f9db12bdb4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421627/normal_5feb510976591.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426828/normal_5fd30d728a401.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387054/normal_5fe24cdceb890.pdfIn PDF document text
    • http://ridaxaki.mywebcommunity.org/42615691283.pdfIn PDF document text
    • https://tevufipe.weebly.com/uploads/1/3/1/6/131606546/zowiz_xijobarelukof_dowanuxovez.pdfIn PDF document text
    • http://nebofonuve.mywebcommunity.org/43386454317.pdfIn PDF document text
    • http://gomesuzos.mypressonline.com/all_quiet_on_the_western_front.pdfIn PDF document text
    • http://veruvipavopa.getenjoyment.net/which_college_is_best_for_mechanical_engineering.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4464850/normal_5ff4be0945415.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb6d6356-9db5-4ac2-aa87-785eaff53d54/pokanupifus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d6d8597a-9973-47af-86e0-00e8dcc1783d/como_hacer_un_a_word_gratis.pdfIn PDF document text
    • http://xologikaju.atwebpages.com/html5_properties_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/92a5fe37-2876-41b0-930f-f9d07f08b9bd/dibokuvirabaxinorejimuro.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d25a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD25A 4476 bytes
SHA-256: c8fccd5b691a6b27e9270dd4031a752c76246863e0d8a5c726c5bf2d9e7e22ee
font_01_sfnt_off0000e23a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE23A 5084 bytes
SHA-256: eb081185b4fcecb77751fc44fe730da035c12954553d1db2efb6198a9833b28c
font_02_sfnt_off0000f369.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF369 9604 bytes
SHA-256: 7db335057a97f548f09d9672bcafa50d10fc3774e7d56a33b7df22dcedd78af2
font_03_sfnt_off00010e6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E6C 13108 bytes
SHA-256: 036df9c8a0fc78b2f547391d16e0cb813fe1e154222031055083cd7a543f63f4

Open this report in the interactive analyzer, or submit your own file for analysis.