Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec52c55e2829a2ac…

MALICIOUS

PDF

76.0 KB Created: 2021-05-21 10:52:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: ec8b053e09a5c136cc1fecace449b656 SHA-1: 195061423f1cdb5f612f2c84179ecc27b5df2e86 SHA-256: ec52c55e2829a2ac3dfd7d2a31a89dde89d52744854752d01b09bce39a79d699
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xajibur.ru/strik?utm_term=why+is+my+dryer+not+drying+properly PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4459180/normal_604badc0e9107.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401723/normal_6016a68b1ec3d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6289d467-cf4b-4301-81ce-e618537625f5/how_to_tell_who_shared_your_photo_on_facebook.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c7824c60-2304-484c-9e8f-11b735511329/how_do_african_elephants_adapt_to_their_environment.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/026442c7-47dc-4279-8246-7d9c90e40333/vikozetuzubof.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a883fd03-153c-4d68-a238-19d965375b5c/3691282240.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c625eb6-2e38-431c-8fc2-4c2f22796e50/how_much_is_the_salary_of_a_microbiologist_in_nigeria.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ee48a235-5ff9-4b1c-8a30-1a92697e3834/amor_en_tiempos_de_colera_pelicula_descargar.pdfIn PDF document text
    • https://s3.amazonaws.com/jupevuxirapi/duzir.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8beb56d9-4f46-4b45-b639-46dfbfaaf302/what_does_the_term_pact_of_steel_mean.pdfIn PDF document text
    • https://s3.amazonaws.com/pesetufavo/reset_medialink_router_to_factory_settings.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d244760c-f019-4ddc-85f3-3090c7c094d4/5480213730.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30a173a3-ec00-4d87-9085-7770747d6572/what_is_the_difference_between_western_and_eastern_concept_of_philosophy.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c7f4ca4f-212a-4a59-b330-025b7fc5c79b/how_to_write_a_script_for_an_animated_tv_series.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5edc0d87-afbc-447a-8840-f9f57fb5c257/xufapo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/209db804-44a2-41f1-9db1-48a96a1a8bc0/an_introduction_to_mathematics_for_economics_akihito_asano.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b5823623-8b7e-4d0e-bb7f-4a597ac43503/usmle_first_aid_step_1_2019.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ec9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC9F 5276 bytes
SHA-256: 0f109f82918378072273c8f69a1fad3ede40afc6e242c1ba602f09842dc3f052
font_01_sfnt_off0000fe7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE7C 10916 bytes
SHA-256: 9d7ebff157ffa19463af0173c835511168e2032758abb58ab74df24097f884ae

Open this report in the interactive analyzer, or submit your own file for analysis.