Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5c051d2e2fbfa97…

MALICIOUS

PDF

242.7 KB Created: 2021-03-31 00:34:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 75b958ce245e7a5eec7c600759105c76 SHA-1: aa9d5343b16cfb245d4babc78e1c6a1b7f65eba9 SHA-256: d5c051d2e2fbfa971e48fc75c248f8052d9af93627820762e9851472f8b3d471
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9896

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=transactions+contemplated+hereunder+%25E4%25B8%25AD%25E6%2596%2587 PDF link annotation
    • https://fokubazukif.weebly.com/uploads/1/3/2/6/132683137/92f7b5207b377.pdfIn PDF document text
    • https://cdn.sqhk.co/subilikiwi/shgmsic/99332736289.pdfIn PDF document text
    • https://fezuliba.weebly.com/uploads/1/3/6/0/136056139/daliw-genurivi-gukawo.pdfIn PDF document text
    • https://rusipamisu.weebly.com/uploads/1/3/4/0/134017355/kunone.pdfIn PDF document text
    • https://voruvagozi.weebly.com/uploads/1/3/4/7/134742827/jegofe.pdfIn PDF document text
    • https://vematonejos.weebly.com/uploads/1/3/1/3/131383464/d2687d3532b.pdfIn PDF document text
    • https://filukekab.weebly.com/uploads/1/3/4/4/134478490/pevarularawu.pdfIn PDF document text
    • https://ragusixiseditof.weebly.com/uploads/1/3/0/8/130814169/8709795.pdfIn PDF document text
    • https://tudaluvakagovax.weebly.com/uploads/1/3/4/6/134614365/botijo.pdfIn PDF document text
    • https://cdn.sqhk.co/luwiwaduna/xuDxibm/vikik.pdfIn PDF document text
    • https://figidurilope.weebly.com/uploads/1/3/1/4/131452961/5411152.pdfIn PDF document text
    • https://cdn.sqhk.co/ropobemuma/ohfjaEw/superhero_fight_club_3._0.pdfIn PDF document text
    • https://pejegenipejixe.weebly.com/uploads/1/3/4/8/134848799/xijovifibuxotep_lubidovato_rumazoradaji.pdfIn PDF document text
    • https://zepazilarewar.weebly.com/uploads/1/3/4/3/134310653/8433535.pdfIn PDF document text
    • https://cdn.sqhk.co/dufolatik/hfkgchi/39430642853.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c29a930b-f212-4c3e-9422-201c2930f082/rodijave.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/22b5f25e-1839-447a-867a-caf17b20dba4/dell_c1765nfw_user_manual.pdfIn PDF document text
    • https://1c92f6d8-19eb-429c-9239-1cf6be91372f.filesusr.com/ugd/cc1a03_2523e18916a54bd389a4e7d97cb191f1.pdf?index=trueIn PDF document text
    • https://6200e599-3f2f-4e3e-ab45-e6977ed7e777.filesusr.com/ugd/f8de3e_71e80417108d410782d33669188ede61.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/69568227-6e53-487b-8e9a-2b9adbdd77ae/interior_designs_home_styles.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000142df.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x142DF 188464 bytes
SHA-256: 12f959092c9b0da172a9b34971cf8fba8022650d0b76e0c02fc025771c602dfc
font_01_sfnt_off000361b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x361B0 3112 bytes
SHA-256: 31a7c526988a7be2ccd0a44e21e48c33e90714b14e453b0dad9e2e322c4d8857
font_02_sfnt_off00036cb5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x36CB5 5260 bytes
SHA-256: 0e615ea1de348249a9a338e033d2a3fd473247a1d05fe66874a0e7f992decadf
font_03_sfnt_off00037e5e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37E5E 11156 bytes
SHA-256: 8aedd1b24c79eae2bb4a7d0d4da4ce5c60105d74f19de604634a1f2c9c22626e
font_04_sfnt_off0003a4b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A4B7 16064 bytes
SHA-256: 7bf06379a60d3316ee48c7eb5657f66f8cadf3c90c6b517b39b71defdd5dff26

Open this report in the interactive analyzer, or submit your own file for analysis.