Malicious PDF — malware analysis report

Static analysis result for SHA-256 d21f82c0702df1af…

MALICIOUS

PDF

155.0 KB Created: 2021-03-20 21:31:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 7669ac2b2156678d6561045755f49c4c SHA-1: 9eaa85ea0f9736c6ccb32590e6560bfcb13688cb SHA-256: d21f82c0702df1afa24f2b2a919c162a685d997475aeb919f605ebe03ada12f5
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1059.007 JavaScript T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a clipboard-command (paste-and-run) lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/123?utm_term=mysql+database+server PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4406775/normal_602071923967b.pdfIn PDF document text
    • http://fipizilemuwob.medianewsonline.com/2020_toyota_camry_xse_red_interior_price.pdfIn PDF document text
    • http://dusanaputojinon.mygamesonline.org/jujivenixowufipopobera.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4497110/normal_5fffec1d8a507.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486053/normal_601f3c72738ed.pdfIn PDF document text
    • http://tokexal.medianewsonline.com/crochet_for_absolute_beginners_granny_square.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374373/normal_6052e89fcc30b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482854/normal_5fcf7bd0b5b8e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387816/normal_603910b760045.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://05efeaee-ea5b-4dc8-bddc-a5098cc0dcbd.filesusr.com/ugd/c06c30_e51d2c9cf22f42418a698463ba6927c4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sumesawoxajew/ecommerce_app_template_psd.pdfIn PDF document text
    • https://45f91bdd-2b68-4e60-ae2c-b14373ae5332.filesusr.com/ugd/0d089b_f4a4a72d9ef244109f0e02e89ed2d090.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/tanapilamaxi/8310555616.pdfIn PDF document text
    • https://s3.amazonaws.com/lanubili/43949350658.pdfIn PDF document text
    • https://01d7ec8a-e38e-4e33-8c76-1be31754498b.filesusr.com/ugd/24d943_e0f25e17c65f449a9f21f8eff48ba5fc.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/janodojivi/good_morning_alarm_clock_mod_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/dezajok/cch_video_ring_t_trn_facebook.pdfIn PDF document text
    • http://xirexadugimog.atwebpages.com/jidufuvagatoporobuligo.pdfIn PDF document text
    • https://s3.amazonaws.com/sevoga/nanamagebajotemi.pdfIn PDF document text
    • https://s3.amazonaws.com/vavale/34434957886.pdfIn PDF document text
    • http://nejesezape.myartsonline.com/wasorefelefuwexowike.pdfIn PDF document text
    • https://627f215e-41ba-4aa4-9906-5f9f9d117739.filesusr.com/ugd/8ab72e_b2f608050d1e45c9a5fc219f733ba882.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xakajoziwibi/for_mac_firefox.pdfIn PDF document text
    • https://1639490a-f715-481e-9fb1-af38d332269b.filesusr.com/ugd/a59130_e5194cee298b454e9f47811b6731444f.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00022179.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22179 5252 bytes
SHA-256: 5ce34916224189c5bbcf0734c8d0babc8628dbccc17c6860828c23349d34aa0f
font_01_sfnt_off00023371.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23371 12856 bytes
SHA-256: 61313b8921ac7fbf5bbce736fb9aa78cee781db4b2e95ad0ee82851df61ffc2c

Open this report in the interactive analyzer, or submit your own file for analysis.