Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3274d364109f182…

MALICIOUS

PDF

118.6 KB Created: 2021-03-17 19:35:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: a88bd18cd1a940029904bdbd5a5230d8 SHA-1: 98ed4adffeb0fa847da9b025de5e356a4ba03209 SHA-256: e3274d364109f182850762d4541446f33e50fc8a0505d54dd3c3d9986fec26a7
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://golowaki.ru/123?utm_term=accel+world+light+novel PDF link annotation
    • https://cdn.sqhk.co/silonifer/5hf8sr4/legion_td_mega_guide.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4414494/normal_600789d11b560.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393632/normal_5fe49ed300fde.pdfIn PDF document text
    • http://magazinrf.xyz/78947405127h19ce.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4497638/normal_5fe021f45f0ad.pdfIn PDF document text
    • http://verenica.net/how_to_solve_symbolic_logic_problems8prob.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372378/normal_601b702ed486e.pdfIn PDF document text
    • http://megatorg.ru/38519120560v6jwd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4459034/normal_60468c171cd02.pdfIn PDF document text
    • https://cdn.sqhk.co/jivazufevi/dSihcif/gogo_live_at_the_capital_center.pdfIn PDF document text
    • http://smcjd.com/tamukowa9laoy.pdfIn PDF document text
    • http://sunny-web.ru/leer_la_biblia_en_linea_gratisv2147.pdfIn PDF document text
    • https://cdn.sqhk.co/vujenibolo/ehjVghi/to_do_list_apple_store.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/muxegeza/nerexomafovidupubekub.pdfIn PDF document text
    • https://s3.amazonaws.com/dugibabafod/how_to_work_a_hamilton_beach_microwave.pdfIn PDF document text
    • https://s3.amazonaws.com/davolazupivowi/http_ebira_reporters.pdfIn PDF document text
    • https://s3.amazonaws.com/zarelusipofox/abc_song_video_mp4.pdfIn PDF document text
    • https://s3.amazonaws.com/widuxade/petrochemical_corporation_of_singapore_annual_report.pdfIn PDF document text
    • https://s3.amazonaws.com/batiku/83522751804.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eba93db2-9c92-48ab-82cc-55a2236654f3/46574104239.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec4e2c67-02f3-471e-9ee6-a8a6dcf0efa2/78818516333.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d0f71890-113b-46e6-9d63-593cb6ce2630/91021238840.pdfIn PDF document text
    • https://s3.amazonaws.com/tipikaxe/delonghi_oil_filled_radiators_reviews.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/86f07513-84fd-41ca-865a-8731a1075482/salon_de_belleza_mario_bellatin_english.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7b68609e-a9df-4213-a15b-c7ad4e67d657/44669355603.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012936.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12936 35108 bytes
SHA-256: 7edb6c74722883d21261adeefd2dfb1862ed2165a8c3acdca4385d2719d5d89c
font_01_sfnt_off000194d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x194D6 4956 bytes
SHA-256: 59729f3b3eb129b1932e94b05ddc14fc36f7752cfdc7f7ddcf8c42670e2238dd
font_02_sfnt_off0001a5c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A5C1 11712 bytes
SHA-256: 405a79cfc580ab9bba06fa2ea6f0b82e5bc767cf0c374eb0985298be7b5e886c

Open this report in the interactive analyzer, or submit your own file for analysis.