Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc70b26883b22169…

MALICIOUS

PDF

77.1 KB Created: 2021-02-24 16:41:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: e9a611c1901d21158d905ee630f7a0b1 SHA-1: b88489da938ba7f119a6a9e590228e1cb523aa38 SHA-256: dc70b26883b221697e841948aefb0d6470477a49eeefdcc612d02f16f9922b84
176 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a ClickFix paste-and-run lure and a clipboard-command (paste-and-run) lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=after+windows+10+update+lost+desktop+icons PDF link annotation
    • https://cdn.sqhk.co/mibemofega/eNiadic/pixx_band_lyrics.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4470830/normal_6004403fdf47f.pdfIn PDF document text
    • https://cdn.sqhk.co/bopibege/vFlgiqw/gutim.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4497359/normal_5fed2be2601fa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451352/normal_60164bec189a8.pdfIn PDF document text
    • https://cdn.sqhk.co/parabeset/jaI3Gig/brilliant_earth_moissanite_weddingbee.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4402247/normal_5fe0f95c0c3d3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4394066/normal_5ffceff75df66.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4478946/normal_5fdc529b7c5f5.pdfIn PDF document text
    • https://cdn.sqhk.co/leperanurosi/fEgcIgd/49939887868.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4411919/normal_5ff1fb7280f87.pdfIn PDF document text
    • http://xekugesakurupab.22web.org/how_to_start_craftsman_lawn_vacuum.pdfIn PDF document text
    • https://cdn.sqhk.co/wibezudak/dVicy4g/63329227849.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409814/normal_5febea35985c4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sisaxu/digital_marketing_concepts.pdfIn PDF document text
    • https://s3.amazonaws.com/fuwawibu/masked_singer_black_widow_full_performance.pdfIn PDF document text
    • https://s3.amazonaws.com/kugelilizibuwum/free_conversational_spanish_worksheets.pdfIn PDF document text
    • https://s3.amazonaws.com/lowebemuwojiso/hbo_viewing_guide_game_of_thrones.pdfIn PDF document text
    • https://s3.amazonaws.com/medaliwifufugel/repifawizetenu.pdfIn PDF document text
    • http://gisatazab.rf.gd/danutibod.pdfIn PDF document text
    • https://s3.amazonaws.com/xidazeze/56141697662.pdfIn PDF document text
    • https://s3.amazonaws.com/rivazixexuguri/didiguv.pdfIn PDF document text
    • http://deweget.rf.gd/power_force_thick_bleach_safety_data_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/wizuluworafid/98965657286.pdfIn PDF document text
    • https://s3.amazonaws.com/buganabowumujef/guxarupadabiwugukekikupuk.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eeaf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEAF 5488 bytes
SHA-256: 334276743db75282af163d82557690a37b18b110937cb57635d4b68fc3d92606
font_01_sfnt_off00010187.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10187 10744 bytes
SHA-256: 6236f554f3979c0c09019b0d486fe8e6d48c2aef8cbeedc732137f715d07ff4d

Open this report in the interactive analyzer, or submit your own file for analysis.