Malicious PDF — malware analysis report

Static analysis result for SHA-256 d079d86d3d05799d…

MALICIOUS

PDF

175.5 KB Created: 2021-03-28 01:53:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 3e28886c5325af503dc512efad05c2e4 SHA-1: d5f078d3be98ff6da55f0824427f84309f2df7ce SHA-256: d079d86d3d05799dc2aecd8133c17363027cd2e81a5b311755738a1b429bdf67
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/wix?keyword=katarina+guide+s5e4 PDF link annotation
    • https://cdn.sqhk.co/monejipo/jhJ0Bkw/god_of_mercy_and_compassion_song.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4386839/normal_5fe22a724f00e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451227/normal_601927e5df175.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465924/normal_6042e0cf1395d.pdfIn PDF document text
    • https://situzofunuk.weebly.com/uploads/1/3/5/3/135305293/847ea78fd6ca73.pdfIn PDF document text
    • https://cdn.sqhk.co/kegufamop/gejeihs/tabisekonevupude.pdfIn PDF document text
    • https://cdn.sqhk.co/fujonexa/jcjfnjA/zombie_s_day_off.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460477/normal_600d44447d868.pdfIn PDF document text
    • https://cdn.sqhk.co/vanewano/hjGigwc/all_star_charity_cricket_match_ipl.pdfIn PDF document text
    • https://xibokesobapud.weebly.com/uploads/1/3/0/7/130776239/puremom_lusinediweb_dejogoraxamasa_korawunoni.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4505096/normal_6059d055f2e0f.pdfIn PDF document text
    • https://cdn.sqhk.co/xopuxuvop/gjjfgfz/ubereats_fleet_app.pdfIn PDF document text
    • https://cdn.sqhk.co/vorowobenune/ibfggji/79354802062.pdfIn PDF document text
    • https://cdn.sqhk.co/vinasujitupe/ijjigi4/bleacher_report_football_browns.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gomaxod/unikey_cho_may_mac.pdfIn PDF document text
    • https://s3.amazonaws.com/pewebopufupe/long_and_short_objects_worksheets.pdfIn PDF document text
    • https://s3.amazonaws.com/tajimipojimo/bissell_powerforce_helix_vacuum_belt_walmart.pdfIn PDF document text
    • https://s3.amazonaws.com/ropidadegaxut/z_black_full_remix_song.pdfIn PDF document text
    • https://s3.amazonaws.com/wazagidonux/zazanakivulotepe.pdfIn PDF document text
    • https://s3.amazonaws.com/zodererezuzuxi/academic_writing_for_graduate_students_4th_edition.pdfIn PDF document text
    • https://s3.amazonaws.com/ronatiduzoxij/were_going_on_a_bear_hunt_song_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000273ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x273EE 5140 bytes
SHA-256: d43b89d480395b55b5c31e493cae4aa1c1283d566e11a0e1c2014f25da620d47
font_01_sfnt_off00028589.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28589 14200 bytes
SHA-256: 50cfd2eb6191c4e6457dcc1c8f3765018b69a8634d4b47189cff5eab2cd0f3ae

Open this report in the interactive analyzer, or submit your own file for analysis.