Malicious PDF — malware analysis report

Static analysis result for SHA-256 d860509d9995e7a7…

MALICIOUS

PDF

76.2 KB Created: 2021-03-23 23:41:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: b312e14f2064eadbb2b07137503ecdc4 SHA-1: 9e6b38a65a70cff729a11187cb203d644fd3f231 SHA-256: d860509d9995e7a767c1d69fc8923b8620d636c4e553fc84448dc2868cec5610
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dugedepap.ru/award?keyword=animation+techniques+in+multimedia+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4457330/normal_602371f12039d.pdfIn PDF document text
    • https://cdn.sqhk.co/jirowolad/hexBMji/dailysale_discount_code.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413850/normal_600129b2b34d2.pdfIn PDF document text
    • http://sokfresh.fun/business_management_certificate_classes66bz4.pdfIn PDF document text
    • https://cdn.sqhk.co/timafewa/ij4whhO/big_time_sports_in_american_universities.pdfIn PDF document text
    • http://grizhoff.ru/1672769949056ecm.pdfIn PDF document text
    • https://cdn.sqhk.co/goduwonon/haIiayC/lepevofopizipoxebakezib.pdfIn PDF document text
    • http://yourcy.com/71218004870wmojz.pdfIn PDF document text
    • http://bu-markett.com/e_aadhaar_with_otpyoit4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e709511-5f59-42a6-859a-53f148c0e0f3/11268126521.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/295ad637-d3fc-417a-b246-57762ff002cc/48042717799.pdfIn PDF document text
    • https://s3.amazonaws.com/silubebebefuju/pajotexudabulawu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/36daf71e-360f-4d6b-a215-26357da5d446/run_jupyter_notebook_from_command_line_windows_10.pdfIn PDF document text
    • https://s3.amazonaws.com/jasipefulaxiduj/96834719138.pdfIn PDF document text
    • https://s3.amazonaws.com/jumedemimo/beginning_r_programming.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8fcb2bf-b954-4421-ab6a-3cd1b64c2a4c/how_to_clean_kenmore_elite_washer_rubber_seal.pdfIn PDF document text
    • https://s3.amazonaws.com/nitirew/contemplate_usage_in_sentences.pdfIn PDF document text
    • https://s3.amazonaws.com/dogevazapiwediw/bavoku.pdfIn PDF document text
    • https://s3.amazonaws.com/zibenoroduzuw/89635930481.pdfIn PDF document text
    • https://s3.amazonaws.com/xumakomowi/fedinokejonerivewipovek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b59f07a5-353f-4482-8854-5c8affa016cd/stress_management_lesson_for_students.pdfIn PDF document text
    • https://s3.amazonaws.com/folexapurilowe/37150600449.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC8E 5416 bytes
SHA-256: ba84b196bcf875427e735775f8e7d97c706dc0deefeb2a8ccb06d9c01a8b44e7
font_01_sfnt_off0000fed0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFED0 10600 bytes
SHA-256: 5c7c809b54c24d667a948f67b7bfb8abd12a094be8d955aab74d8fef748b1685

Open this report in the interactive analyzer, or submit your own file for analysis.