Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce772e70c21eb362…

MALICIOUS

PDF

244.0 KB Created: 2021-06-05 20:49:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 6f3b8e4094d0a017fcf787cacc667b67 SHA-1: 9d23fae30a578101d67bb344242a5284dac51823 SHA-256: ce772e70c21eb362783f4f1ee6128d886c060848aca6dae66c22d889364c5b8e
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9914

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/pbw?utm_term=how+to+prepare+for+420 PDF link annotation
    • https://jenifamizoj.weebly.com/uploads/1/3/5/3/135319667/debe271612a8b.pdfIn PDF document text
    • https://komovifewujip.weebly.com/uploads/1/3/4/8/134895136/2f0cd9f.pdfIn PDF document text
    • https://zixojubagever.weebly.com/uploads/1/3/4/6/134613499/f0574c634f2.pdfIn PDF document text
    • https://subifegeriw.weebly.com/uploads/1/3/5/3/135348524/2310584.pdfIn PDF document text
    • https://kurokeduzuw.weebly.com/uploads/1/3/4/6/134693898/1741773.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384039/normal_60149f18d67a8.pdfIn PDF document text
    • https://simipupipez.weebly.com/uploads/1/3/4/7/134716676/9f627.pdfIn PDF document text
    • https://jipuziloki.weebly.com/uploads/1/3/2/6/132695969/vimosefofev.pdfIn PDF document text
    • https://semumivotuwebaz.weebly.com/uploads/1/3/4/3/134379403/nojinobavusaxaxa.pdfIn PDF document text
    • https://rugexosijebup.weebly.com/uploads/1/3/4/0/134017508/zemoned_tivonir.pdfIn PDF document text
    • https://gojefofowuf.weebly.com/uploads/1/3/4/5/134596001/4214600.pdfIn PDF document text
    • https://bufujibuku.weebly.com/uploads/1/3/4/8/134862056/zinuweku.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4497685/normal_5fd61e5139696.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4469126/normal_5ffa360e9eece.pdfIn PDF document text
    • https://sogegagep.weebly.com/uploads/1/3/4/6/134687839/c9f1d923c.pdfIn PDF document text
    • https://zipobirin.weebly.com/uploads/1/3/5/3/135386694/7db978e57886e.pdfIn PDF document text
    • https://paweweribawu.weebly.com/uploads/1/3/4/6/134656346/fdcd7d23b.pdfIn PDF document text
    • https://xipunozelizu.weebly.com/uploads/1/3/1/3/131382486/6fea6415d41.pdfIn PDF document text
    • https://lemosipezo.weebly.com/uploads/1/3/5/3/135326275/7790839.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/2cb59115-4dca-412c-954d-8e7741d4b0c3/devilbiss_air_compressor_manufacturer.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2cfaf26d-8019-46de-bf6c-0893ce419409/30826659975.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f1377ba-f137-4672-8a9c-00c4f9473d27/plan_y_programas_de_estudios_2011_tercer_grado_primaria.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e52aac4d-f171-4b45-98ca-6e48dd044992/27696948913.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/081df9c5-67ad-4605-b3eb-82eba6495bd6/diccionario_medico_oceano_mosby_descargar_gratis.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000383c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x383C6 5100 bytes
SHA-256: 35a20059fdacd3e515066a89c2060e50f407d2c2e1615b3d589bc801ed1036ad
font_01_sfnt_off00039547.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39547 13768 bytes
SHA-256: e9b3e3ed5fcbbfe6e660d96270dedba09fa57c4891353d239f82365be4a96ab8

Open this report in the interactive analyzer, or submit your own file for analysis.