Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb159b2b126ef455…

MALICIOUS

PDF

88.9 KB Created: 2021-04-29 20:56:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: c6745fa979bdf4ed7e2d51e4147447b1 SHA-1: 5f10601d219a4a9a2b5d9f996de85f2e7e63f55e SHA-256: eb159b2b126ef455821b74a7f59f302d3c7a11184454eec9f2bb90462f42f0b1
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gimoguvi.ru/strik?utm_term=how+to+make+easy+homemade+blueberry+wine PDF link annotation
    • http://buybritishcat.com/how_to_repair_a_panasonic_microwave_door_latch51osz.pdfIn PDF document text
    • http://saudiautoinsurance.com/the_dictator_2012_full_movie_youtube1w1ok.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420438/normal_6017d8e502bfe.pdfIn PDF document text
    • http://kelimap.mywebcommunity.org/asthmatic_drugs.pdfIn PDF document text
    • http://ketrovk.xyz/93358714535f0pvi.pdfIn PDF document text
    • http://nigoguno.scienceontheweb.net/48844423483.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375896/normal_601d5f677ab56.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453563/normal_600b117a7a360.pdfIn PDF document text
    • http://harmony-market.ru/55762774456yefbi.pdfIn PDF document text
    • http://prizyivnik.ru/wcu_liberal_studies_checksheet_spring_2019c71fq.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422137/normal_6030ef0d783e0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://kesupipipiret.onlinewebshop.net/hungry_jacks_vouchers.pdfIn PDF document text
    • https://s3.amazonaws.com/kikunojulejuj/blaupunkt_tv_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/wiwuxot/vefululepowalikuw.pdfIn PDF document text
    • https://s3.amazonaws.com/fadupazageraf/9722584723.pdfIn PDF document text
    • https://s3.amazonaws.com/vufuzewasi/woocommerce_authorization_header_malformed.pdfIn PDF document text
    • https://s3.amazonaws.com/senodiw/kerubezikekazameg.pdfIn PDF document text
    • https://s3.amazonaws.com/wurivuve/automobile_bill_of_sale_fillable.pdfIn PDF document text
    • https://s3.amazonaws.com/daraniwekamidir/lowes_duraflame_3d_electric_fireplace.pdfIn PDF document text
    • https://s3.amazonaws.com/wifukedot/ccna_lab_guide_routing_and_switching.pdfIn PDF document text
    • https://s3.amazonaws.com/rimejiguvif/68355292456.pdfIn PDF document text
    • https://s3.amazonaws.com/luropiw/bufabifux.pdfIn PDF document text
    • https://s3.amazonaws.com/ninasivol/fijufuwesegizataj.pdfIn PDF document text
    • https://s3.amazonaws.com/labitajaxatufib/funufozogoniru.pdfIn PDF document text
    • https://s3.amazonaws.com/kegubinefuda/lowrance_elite_ti2_hdi_7_in_gps_fishfinder.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001057a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1057A 5424 bytes
SHA-256: 4085720c52ac4c0498a14cf482467232de7468fd904cf15c0696e0054f606cba
font_01_sfnt_off000117cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117CD 11648 bytes
SHA-256: 8c4fedfa869b1f1205293256bfe7cfc82f51ccda8eca4aa4b4a0c48fed07b59c
font_02_sfnt_off00013fc9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13FC9 16312 bytes
SHA-256: 975089639afea594160f6daa1ae948ffc4125994d61a9fd32dce02580f7b6b15

Open this report in the interactive analyzer, or submit your own file for analysis.