Malicious PDF — malware analysis report

Static analysis result for SHA-256 eac15fb11cf555e5…

MALICIOUS

PDF

81.4 KB Created: 2021-05-08 07:28:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 5ae78385ed72d0b25af16126567d380b SHA-1: 533399191e1c8d9a1e4d96306e040387c2786ef6 SHA-256: eac15fb11cf555e551d9c15b00a4dab2e529b39d88cc227fb88696084805477f
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://midufefew.ru/strik?utm_term=how+to+connect+jbl+flip+2+to+ipad PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4448121/normal_602bf5e794fb2.pdfIn PDF document text
    • http://seritepaxuv.22web.org/how_to_write_a_reflective_response_to_an_article.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390374/normal_6035860891b04.pdfIn PDF document text
    • http://tejanexes.iblogger.org/solving_simple_linear_equations_worksheet.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zemunomipazikez/video_games_to_play_with_friends_online_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd63a9ff-d5a3-4049-92c6-7c19fa194db2/56486820476.pdfIn PDF document text
    • https://s3.amazonaws.com/fadedosi/22312813352.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b0029336-4cb9-4654-8896-06e8a820da65/psychology_11th_edition_myers_citation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c89622b8-5a4e-48dd-982e-5ee816a5ea8e/image_of_gandhiji_with_charkha.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7bcda465-8cf3-41f8-be5d-45e34aa1331b/85674145473.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b95df1f4-c6fa-4581-98fd-96396d8b2ac7/11094665753.pdfIn PDF document text
    • https://s3.amazonaws.com/toliwudalamem/tunisigosererosi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7932b95f-b10c-4347-b29b-e759e5d24868/noun_worksheet_for_class_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d14ee84-fc86-432b-a122-a37fe4cb7d29/how_much_will_the_tesla_model_3_cost_in_canada.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a26cc04-013d-45a2-8950-524fd5afb47c/como_perder_peso_dieta.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2663b7c-9dcd-44db-b647-4d51f6569ba3/how_to_reset_your_sentry_safe_code.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5470d10-bb08-4206-8546-89b821ac0dc6/washington_dc_newspapers_sports.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/145e0650-dd69-4720-b19b-dd04e19e9f80/20129664737.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b86d3fec-dec5-442e-a218-b0ac87f28c2c/mawubosawomimulixo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c17cc0d8-20fc-49d0-93f7-0ee33b6b34e4/xuxapako.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dbaeb68a-3d95-45e3-a73f-e2c10c109528/73082975920.pdfIn PDF document text
    • http://moxutomib.rf.gd/66743849565.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd16.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD16 5276 bytes
SHA-256: 4af728bc50810795b94ccd1810d8da0e705959bb52186c8628fd4ec191cab7a7
font_01_sfnt_off00010f30.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F30 12604 bytes
SHA-256: 8ec88baf49adf0eed3760acc8fcbf7ade307e999e3f97e107e2eb1540c7111b9

Open this report in the interactive analyzer, or submit your own file for analysis.