Malicious PDF — malware analysis report

Static analysis result for SHA-256 e17a8390f911a0a2…

MALICIOUS

PDF

76.7 KB Created: 2021-05-20 19:39:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 51b5c81ad36a09525e2fc84b6bf55d25 SHA-1: 8d23f9e7eb31c6b67fe0fad30e334a95f7b43a8c SHA-256: e17a8390f911a0a2e0fffb4795c5a752661a6a214f22240c6ed4e99e8225e2e8
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=qu%25C3%25A9+significa+so%25C3%25B1ar+con+que+se+me+caen+los+dientes PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4374021/normal_606205e4efd73.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366646/normal_5ffe54fb6e4a8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447433/normal_5fd35014b8dc1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368977/normal_6015632bd9751.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376404/normal_604b235e0bd6d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486033/normal_60119bf10bc8c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4380705/normal_5ffda37fd5b03.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467945/normal_60284647d39ff.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381090/normal_601b048f6d533.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459034/normal_603c890a7b523.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393204/normal_5fc988d06ecca.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4380405/normal_5ffb1cf1c02be.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4506170/normal_60598a2c511de.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489245/normal_600da82f95b39.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4491933/normal_5fe97c5c9fbe4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375095/normal_604d71366fc95.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4378379/normal_5fdf2d5183cc8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417643/normal_6041744d5a905.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1bff037a-b310-4730-acea-96c43fddc689/14624542989.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e7a822da-679c-4965-8c1a-11b9fe70256a/zebiribi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f9f03662-bafd-4821-8601-ff75a5b77768/koxiw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68ac7f68-2677-4970-abaa-b5a9584859a4/69159163507.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec0a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC0A 5884 bytes
SHA-256: 4310c33f53c266c01b13c4a2cd0f49486a62c1e32341b2fecb16d1da4853b876
font_01_sfnt_off0000ff74.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF74 10936 bytes
SHA-256: 0c53b374d38f55eea0ed1f803c998cd8acdd40b0648e98c73669b1b9454fcb5d

Open this report in the interactive analyzer, or submit your own file for analysis.