Malicious PDF — malware analysis report

Static analysis result for SHA-256 d41e8aa4c842978c…

MALICIOUS

PDF

164.6 KB Created: 2021-02-28 23:56:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: eeb0f32e5eedf49377fae5fa89d15d43 SHA-1: 96d95e8ddcb62c2c3e864326ae8d6baedc6317c7 SHA-256: d41e8aa4c842978ca839aa7b3f6961e4d6a0c9e61e1cdbdf96ec2fe474c07491
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=how+many+death+note+books+are+there+in+the+series PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4411681/normal_5ff3003c7ad0d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379984/normal_602c8980a5e4e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417824/normal_6004e717299a3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389585/normal_6012f9d36ea97.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413004/normal_5fc9797184911.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370985/normal_6027f8eda54dc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425217/normal_5fec9f26f3f89.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393033/normal_5fde84625458b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384299/normal_6016791ddb725.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443803/normal_6020b6729b19b.pdfIn PDF document text
    • http://balegetiwep.mywebcommunity.org/anet_a8_3d_printer_cura_settings.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4373997/normal_5fef633ab645a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419452/normal_601662411a213.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366042/normal_60360d55b6106.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404739/normal_6013e91e4e23a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383471/normal_5ff66cfb1f89b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xulikamul/animals_name_with_images.pdfIn PDF document text
    • http://ratobewiwigu.atwebpages.com/takigavumisejesegiz.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001c60f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C60F 32656 bytes
SHA-256: 398e889833cf5c2c46d04e21a607407dfabe9aab9c0ccf5294029c6a98b36398
font_01_sfnt_off00022bc2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22BC2 5392 bytes
SHA-256: a9f8f31a3311ce947b3c75f77a0e702d32baaaa660fdc101fa36f4b520f77a10
font_02_sfnt_off00023df9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23DF9 15656 bytes
SHA-256: 8c9ae92b317025e93abbf395ab654c67f641bcae6f12ff56dc71e34111d0a63b
font_03_sfnt_off00026e0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26E0B 16236 bytes
SHA-256: 07c7167abbf6a17d9a9a17307a03ced31c0e245be33d4f13a65b6558407d89df

Open this report in the interactive analyzer, or submit your own file for analysis.