Malicious PDF — malware analysis report

Static analysis result for SHA-256 df31e4e83a0edc3b…

MALICIOUS

PDF

71.9 KB Created: 2021-03-21 04:09:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: cc4be7eed065e1550a3d04baf2f6136f SHA-1: 5e2eb86fec31b10d72517db563c8e2f14e282551 SHA-256: df31e4e83a0edc3b33c9d23e527acf9fdafb6433e00f01f5bfa76677205811e8
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=arc+length+radian+measure+worksheets PDF link annotation
    • http://worigozuwujuva.iblogger.org/nukilofu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/17b8da5b-cb53-4bb8-a8b8-6bd712dcaaf9/armor_of_god_bible_study.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5bb647e-f561-45eb-aabe-5a13234ff793/dirt_devil_power_express_ud20120_belt.pdfIn PDF document text
    • https://s3.amazonaws.com/zowejunef/xikixix.pdfIn PDF document text
    • https://s3.amazonaws.com/zarusegibitumet/nirazasabivufigusese.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/183452b9-6343-4fcd-8ff8-89e483d09bc3/74381972452.pdfIn PDF document text
    • https://s3.amazonaws.com/pirofopafu/84376885490.pdfIn PDF document text
    • https://s3.amazonaws.com/remuv/84902150681.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/60e6b6c3-813b-44e0-946f-c8ade9118bc5/what_cause_childhood_trauma.pdfIn PDF document text
    • http://sulasusiramoti.epizy.com/restaurants_surry_hills_broadsheet.pdfIn PDF document text
    • https://s3.amazonaws.com/wovugi/newabo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/001e3c81-776f-4a94-90da-ac32256f0f8f/kukoviposedibexe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/706b42d5-f1af-4316-b83f-d0793152eb93/software_testing_life_cycle_steps.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b17923d9-6b93-461f-9ac9-55303c6c77f0/96663371086.pdfIn PDF document text
    • https://s3.amazonaws.com/dobikasukavu/guidestone_financial_login.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ece8522-4a1e-4011-8420-ae2528778834/35796133040.pdfIn PDF document text
    • https://s3.amazonaws.com/nufidibodudulad/minecraft_industrial_craft_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b809e0a-7aec-4e1a-b316-1783c546e0fb/39378706566.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f61d51b-80c3-4c61-a8dd-06c939e7d296/citizen_skyhawk_at_limited_edition.pdfIn PDF document text
    • https://s3.amazonaws.com/legesiliv/aladdin_song_2019_free.pdfIn PDF document text
    • https://s3.amazonaws.com/bitizopovopaso/how_to_make_attendance_report_in_php.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d949.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD949 5496 bytes
SHA-256: 040c5df2c73ecb8d1532dc97d73e0c33a8e0050b8e037622df70ff602a732774
font_01_sfnt_off0000ebdb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBDB 11264 bytes
SHA-256: 7f06b599ff8054b86e3e77cd7d2911b3bcc752d831ab8e3926974c0bae12444a

Open this report in the interactive analyzer, or submit your own file for analysis.