Malicious PDF — malware analysis report

Static analysis result for SHA-256 de0b6bece027e657…

MALICIOUS

PDF

218.6 KB Created: 2021-04-06 05:18:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 5caf525ec90b09d74e2e5d186f83e8f9 SHA-1: 8be0752ace181d7ad7f6a42856526a907a859a4f SHA-256: de0b6bece027e657465816634cab3cd7cf1b8e7219075bdd9d49dfc23d422785
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9945

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=hebrew+new+testament+in+english PDF link annotation
    • https://fejigurize.weebly.com/uploads/1/3/4/5/134509658/cc9f55ab3.pdfIn PDF document text
    • http://nejevefivi.mypressonline.com/carbohydrates_nios.pdfIn PDF document text
    • https://polovetanofup.weebly.com/uploads/1/3/5/3/135330247/93009.pdfIn PDF document text
    • https://lojijuzirikoza.weebly.com/uploads/1/3/4/5/134593465/2046571.pdfIn PDF document text
    • http://zumanidoxup.medianewsonline.com/vivuleguji.pdfIn PDF document text
    • https://zorusijumabek.weebly.com/uploads/1/3/4/8/134851431/eacd5610d.pdfIn PDF document text
    • https://femesavez.weebly.com/uploads/1/3/1/3/131383434/luvamafulalul-mafuroror-duros.pdfIn PDF document text
    • https://zobojosapez.weebly.com/uploads/1/3/1/4/131483592/nizaxakofavezerinewu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kulebosux.myartsonline.com/african_countries_capitals_and_currencies.pdfIn PDF document text
    • https://f0ddeb88-3549-4a27-8821-6e3dd713f165.filesusr.com/ugd/2b74da_f1d461b589414f64a66eb625b9f7f388.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/849b32cd-8904-4d49-97e3-06b192bb6022/who_played_bruno_in_the_boy_in_the_striped_pyjamas.pdfIn PDF document text
    • http://sugamane.onlinewebshop.net/il_decameron_di_giovanni_boccaccio.pdfIn PDF document text
    • https://e05bdd54-7536-4db1-b7ed-110d7b12163e.filesusr.com/ugd/dd5a80_403acfd72277469582ff7eef8b820f3a.pdf?index=trueIn PDF document text
    • https://7d33af4c-acfd-4996-9436-348e89828b5b.filesusr.com/ugd/289672_8cd6d72120d44e9bbcc3a110c56d4dc5.pdf?index=trueIn PDF document text
    • https://709e7e89-b264-4d73-b757-064736ed86f1.filesusr.com/ugd/f523c3_169ea4426d8240de90032fc27f48ab60.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/481d74f7-d772-423c-93a0-16f4c3a9de8f/tipos_de_comunicacin_oral_debate.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ec0131d-9ad4-4226-969d-4adeacec2067/are_nuts_ok_on_fodmap_diet.pdfIn PDF document text
    • https://fad58b31-c538-4d3f-828d-7998eec853b9.filesusr.com/ugd/7e6083_629d196dc026424ea75dfdef8cd17240.pdf?index=trueIn PDF document text
    • http://fepusum.onlinewebshop.net/bonsai_arboles_en_miniatura.pdfIn PDF document text
    • https://3794eb9c-cc8b-492c-aecc-44533f76aaa6.filesusr.com/ugd/1ee69b_52e7ca640e6d4f73b88edcf2749606e5.pdf?index=trueIn PDF document text
    • https://aee666f7-65d2-4416-8089-42e5bd85255d.filesusr.com/ugd/c4036c_94d369eb6dc743f5a021039bc82e7085.pdf?index=trueIn PDF document text
    • https://73a1781f-5c9f-4c76-8a11-a8e8c44f336a.filesusr.com/ugd/d9f7b5_8f05dec48f994d36ba1e22879c574bf9.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/9b432e98-88dd-47d5-9962-0e0e723a89e8/drug_guide_book_for_nurses.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00031548.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31548 5292 bytes
SHA-256: b874ffc499a5c9f1535abb9af69167fe3d74579ec9000124111c8439b3da6dd3
font_01_sfnt_off00032727.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32727 16488 bytes
SHA-256: b3999fa9f23b8e9876574eec82f57f0623b0760b34d777c0cba71e94f055ed02

Open this report in the interactive analyzer, or submit your own file for analysis.