Malicious PDF — malware analysis report

Static analysis result for SHA-256 d692f9132c6871f3…

MALICIOUS

PDF

72.5 KB Created: 2021-02-16 00:02:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: b44499317aa6f065d1b95c4207b35a03 SHA-1: a6c98a12a172c4ff2dae25c4499b9c80612be482 SHA-256: d692f9132c6871f312fe158706eabaebf29ed7154a1f1983d95e43f02f90e688
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=v+number+calling PDF link annotation
    • http://macsk.space/alexa_echo_2nd_generation_user_guideswz3l.pdfIn PDF document text
    • http://magazinrf.xyz/ls_engine_build_sheetuii0f.pdfIn PDF document text
    • http://apple-fruit.space/raniganj_araria_weather_reporthpstq.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4424331/normal_600183b346540.pdfIn PDF document text
    • http://banque-populaire.best/super_disco_breakin_liveknh6t.pdfIn PDF document text
    • http://kneeksi.ru/average_pc_repair_costt6hz0.pdfIn PDF document text
    • http://arbitestpark.xyz/seven_habitsapt0c.pdfIn PDF document text
    • http://blablablacar.online/where_is_my_mind_drum_sheet_music3np4t.pdfIn PDF document text
    • http://shoppingyxplus.xyz/harvest_hosts_californiaz91qc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481663/normal_600e938c43d51.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4403683/normal_5ffa7df42f197.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413564/normal_6011e07555f1c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387938/normal_601180a02f308.pdfIn PDF document text
    • http://sk-anker.ru/alexander_henderson_ielts_reading_answersjoyf4.pdfIn PDF document text
    • http://help-feedback-amzn8.xyz/dictionnaire_medicale_francais_anglazeazi.pdfIn PDF document text
    • http://formulamoney.top/mobovau1qh5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409616/normal_5ff4c220d6742.pdfIn PDF document text
    • http://4gusevshop.space/4112352699ht1ym.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/satudifin/gettysburg_movie_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/tawovojo/cyborg_she_free.pdfIn PDF document text
    • https://s3.amazonaws.com/putelekireza/zedojazuwokobosi.pdfIn PDF document text
    • https://s3.amazonaws.com/rokuwapesu/solid_wood_platform_bed_frame_with_storage.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e0c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE0C8 5044 bytes
SHA-256: da3fe5fdea635a33413a4da0b8c6ff739a2737aadc7ba7df2faab30a6a046abe
font_01_sfnt_off0000f1dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1DD 10396 bytes
SHA-256: 1c991035c4216ab491cf71e43ed18f528ff47bc415e3f2d212ea826d20087ba9

Open this report in the interactive analyzer, or submit your own file for analysis.