Malicious PDF — malware analysis report

Static analysis result for SHA-256 d671f2f0a98249ca…

MALICIOUS

PDF

74.2 KB Created: 2021-03-16 22:22:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 11c19a007240912bcaab78239b8b0c15 SHA-1: 59bd6c646586c7d2a8ebc9705aafe91c7d982dc7 SHA-256: d671f2f0a98249ca6af3c08efdfe449bb91d6865dc9f96d717797e81ae6e6617
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=how+to+clean+avent+electric+steriliser PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4376850/normal_6020cc552fcb1.pdfIn PDF document text
    • https://cdn.sqhk.co/tikugosedik/iOWFmOh/95090673650.pdfIn PDF document text
    • https://cdn.sqhk.co/bumogebiz/SGibShg/meteor_shower_22_april_2020_uk.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452621/normal_6035e3f72de2f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4506159/normal_6036a922b4843.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476783/normal_5fd97af3ae175.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://jirizaxewusi.epizy.com/38884672634.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/00a3ea55-f7c8-4e8c-b815-81ba7137d7fa/murray_mower_deck_bearing_replacement.pdfIn PDF document text
    • https://s3.amazonaws.com/jitimesolagun/cauda_equina_mri_report.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d7fefd7-5f06-4221-adc3-cdac6031f70e/css_the_missing_manual_github.pdfIn PDF document text
    • http://sewugobavi.rf.gd/namujedeweku.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6bff5a33-519f-46ce-bd39-abcec9344309/how_to_get_your_workers_permit_in_massachusetts.pdfIn PDF document text
    • https://s3.amazonaws.com/tapelu/tifevaw.pdfIn PDF document text
    • http://xusazaja.epizy.com/9679408806.pdfIn PDF document text
    • https://s3.amazonaws.com/jitimesolagun/67667715696.pdfIn PDF document text
    • https://s3.amazonaws.com/loneminovu/49824221758.pdfIn PDF document text
    • https://s3.amazonaws.com/napisakaluja/watch_free_tv_channel_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/zifilobesumafi/kisasifupoxakotowi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2c6cadbb-063f-463f-86ca-97c85437697b/ludimuwugixulotebaz.pdfIn PDF document text
    • https://s3.amazonaws.com/bufipevuril/tozosexa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8f11da7-a5ed-410a-86ac-3839b67c8ef5/laroduku.pdfIn PDF document text
    • https://s3.amazonaws.com/nigimul/ada_diabetes_treatment_guidelines_algorithm.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3D6 4904 bytes
SHA-256: 584d9cd050a0bd44aea47a716eda321493b674db7b3048a8e0440f8d02c02043
font_01_sfnt_off0000f4a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4A7 11060 bytes
SHA-256: 9e3967ce8509019f7614217d62934556e3918c0c77899b08d333e2ea90d4d879

Open this report in the interactive analyzer, or submit your own file for analysis.