Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea9394bdb4c5bf36…

MALICIOUS

PDF

75.4 KB Created: 2021-05-24 13:37:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: e894ac22b92460e4016326cb4c18b6b3 SHA-1: 3aa3f5066527d34469a3c4a8d77033e0bd3911ec SHA-256: ea9394bdb4c5bf3664d78c4316bc5ae132e6f9869f9494529be1e1bb58740c34
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=bass+guitar+tutorial+for+beginners+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4450242/normal_60062c595652c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484612/normal_5fea1a42a4feb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387229/normal_604924d8cbf59.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386334/normal_602df6a98af08.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480403/normal_601b4d4882497.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474445/normal_605bddaf57ee4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485807/normal_602ecc17e60e9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378853/normal_5fd5ff97bc79b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/mejados/5770067003.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc54ac62-29ca-4976-996e-68bc48bb3528/84783188165.pdfIn PDF document text
    • https://s3.amazonaws.com/matogapibelifiv/crayon_box_coloring_template.pdfIn PDF document text
    • https://s3.amazonaws.com/bejeseja/37469796427.pdfIn PDF document text
    • https://s3.amazonaws.com/rumezo/sharp_microwave_drawer_installation_instructions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f3a4fc56-106c-4736-a9c4-2193b299abd6/31442975507.pdfIn PDF document text
    • https://s3.amazonaws.com/neporezofov/extensiones_video_er_pro.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0b35c61-9adc-406a-958b-1a23acad067a/39479364749.pdfIn PDF document text
    • https://s3.amazonaws.com/batoragubukepo/bedtime_stories_film_soundtrack.pdfIn PDF document text
    • https://s3.amazonaws.com/runuzitexokol/small_building_images_hd.pdfIn PDF document text
    • https://s3.amazonaws.com/bisegilupuf/48986302623.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d846e70-b441-45a1-9f08-0261f9b2603d/mnps_payroll_calendar_2020-21.pdfIn PDF document text
    • https://s3.amazonaws.com/wefadep/xalunimolajibetekivaf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d189672a-714d-4771-9ffd-6860764a3657/the_secret_life_of_bees_audiobook_chapter_7.pdfIn PDF document text
    • https://s3.amazonaws.com/vukusa/solving_polynomial_equations_by_factoring_worksheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e712.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE712 5396 bytes
SHA-256: 50f1bc5c602b63f3b7d451488eaf2e4dbba522937eaecea7333d31747ea86844
font_01_sfnt_off0000f976.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF976 10848 bytes
SHA-256: 34b8b32968a263406455568ccf79bcb4f03d4fcbfdf092a1f05cb2a98cdd542c

Open this report in the interactive analyzer, or submit your own file for analysis.