Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3e0629e6869aa49…

MALICIOUS

PDF

199.6 KB Created: 2021-03-26 05:51:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 5bb5bef87c1641ae2e92f633f4bad490 SHA-1: 2afdcffcad6070ce4eb622dc9417825e9ce66b16 SHA-256: e3e0629e6869aa49900bc9a11572fa4fc8aaeeed5defb8bb66f4f0f4d0ae1378
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/award?keyword=logical+fallacies+list+and+definitions+pdf PDF link annotation
    • http://idealica-co.site/36988215555m7za1.pdfIn PDF document text
    • http://songkfrk.site/structural_analysis_9th_edition_cheggip10w.pdfIn PDF document text
    • http://pexawegowe.mywebcommunity.org/belt_and_road_comic_book.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413712/normal_60140c2b53ee2.pdfIn PDF document text
    • http://online-bestshop.xyz/how_to_treat_severe_anxiety_in_teenagerwdf1c.pdfIn PDF document text
    • https://cdn.sqhk.co/varomapit/rwCwieM/688919354.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385206/normal_5ffe7af4101de.pdfIn PDF document text
    • http://mujudesuxiropa.sportsontheweb.net/goviwutemafutiluvot.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454180/normal_6022c1798f3c9.pdfIn PDF document text
    • http://ferategaj.scienceontheweb.net/water_pollution_project_for_college_in_bengali_language.pdfIn PDF document text
    • https://cdn.sqhk.co/tefazaturar/jb9hbji/30900278242.pdfIn PDF document text
    • https://cdn.sqhk.co/jasowipe/ia86Tii/behringer_u-_phoria_umc404hd_manual_espaol.pdfIn PDF document text
    • http://raisinsapp.pro/how_to_make_ribbon_bows_for_giftsgr4u1.pdfIn PDF document text
    • http://lnstagramcopyrightcenter.com/racecards_racing_postdomp2.pdfIn PDF document text
    • https://cdn.sqhk.co/tamaladafa/Nhcjgdy/mefab.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/7a46e22d-09fb-4bf4-86a8-d76a5e4feff9/68136846798.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f0be9b6b-6cc9-4fd7-a08e-6f28480c4dff/crosley_record_player_power_cord_5v_1a.pdfIn PDF document text
    • http://mawokale.myartsonline.com/durozegexidolawerukorek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b199705-dbc6-4181-a492-8b90003e34b7/siwufozabibatavatipigomo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002c7c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C7C9 4956 bytes
SHA-256: 75cca6b4ad51148279d300c22fbb89e0abb0f1e91997f8afc47c2e30c852b17a
font_01_sfnt_off0002d8bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D8BB 13256 bytes
SHA-256: e803f62f09590d28e32e01d37154dabd28838236c9e2faafe967c1face48e776
font_02_sfnt_off00030264.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30264 4324 bytes
SHA-256: 7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71

Open this report in the interactive analyzer, or submit your own file for analysis.