Malicious PDF — malware analysis report

Static analysis result for SHA-256 da352a3b602bab76…

MALICIOUS

PDF

80.2 KB Created: 2021-04-07 21:42:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 163193fe213390e5c15456d3498dd900 SHA-1: c8a64abe43116ce8f9e067df170e5c788cbcb5d0 SHA-256: da352a3b602bab761897fb75939cff62b4ad4e954d291ca8c3da809d43fa17f4
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=sears+craftsman+air+compressor+owners+manual PDF link annotation
    • http://cardio-natural.info/taurus_pt111_gen2_9mm_pistolqze28.pdfIn PDF document text
    • http://kalavar.xyz/sofakas4bxc.pdfIn PDF document text
    • http://firstsecu-paypal.com/screwtape_letters_politicsek5fb.pdfIn PDF document text
    • http://carinsusa.info/spectrum_math_workbook_grade_8_free92cvz.pdfIn PDF document text
    • http://padlamadla.site/nezonolazobobaggpr1k.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/jazamerijekufol/hawthorns_school_bletchingley_uniform.pdfIn PDF document text
    • https://s3.amazonaws.com/kezemiradigu/1496928885.pdfIn PDF document text
    • https://s3.amazonaws.com/sizabo/rajumek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c017b26f-6a09-447d-913a-e4e223c3a76b/romeo_and_juliet_act_4_scene_1-5_summary.pdfIn PDF document text
    • https://s3.amazonaws.com/didowugorokirug/mekos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40a3eddb-6fda-4bf5-85e3-8002566adecf/varowak.pdfIn PDF document text
    • https://s3.amazonaws.com/xumakomowi/atlas_lathe_spare_parts.pdfIn PDF document text
    • https://s3.amazonaws.com/jotizifime/critical_path_method_in_project_management.pdfIn PDF document text
    • https://s3.amazonaws.com/rovuweraja/become_a_court_reporter_in_sc.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/25ec38e2-1bd2-40d8-9db2-5c5146bb8ff6/66329943208.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/207487b6-fd36-4c21-84ad-ba8f72c6211a/how_to_pair_xr2_remote_to_tv.pdfIn PDF document text
    • https://s3.amazonaws.com/busutafitufe/are_invicta_reserve_watches_any_good.pdfIn PDF document text
    • https://s3.amazonaws.com/rupatojuko/67331170669.pdfIn PDF document text
    • https://s3.amazonaws.com/vidadaviwal/square_root_calculator_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/povodijirig/how_to_reset_a_brother_printer_after_replacing_drum.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED18 5240 bytes
SHA-256: 08c54ebed23e2c01406664728f462f2fb1375c781152bdb1d1ec320717d7cb4a
font_01_sfnt_off0000fed8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFED8 11460 bytes
SHA-256: 96af5ded8e9dc08cb93d5461f78beed1e35c3bce87ae5bbeb585ea1217a750e3
font_02_sfnt_off0001255c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1255C 4324 bytes
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71

Open this report in the interactive analyzer, or submit your own file for analysis.