Malicious PDF — malware analysis report

Static analysis result for SHA-256 f062ee6d0ab4271f…

MALICIOUS

PDF

84.3 KB Created: 2021-04-05 19:42:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: d802b12435fc05fbdacb9520816fffdf SHA-1: 1b1bc91b23e66a13d739ee54360de1d10fc107c2 SHA-256: f062ee6d0ab4271ffce38cd1c6656b9e8dbdad84e474c568e8dcc0e10b676f7a
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/strik?utm_term=in+cold+blood+book PDF link annotation
    • https://cdn.sqhk.co/fokatekox/gjehdmN/baahubali_movie_songs_ringtone_pagalworld.pdfIn PDF document text
    • https://ladupizisegi.weebly.com/uploads/1/3/1/3/131380895/lonak.pdfIn PDF document text
    • http://talivur.22web.org/tibonuvizovavemix.pdfIn PDF document text
    • https://cdn.sqhk.co/lirebirab/gdd86uO/stick_shift_meaning_in_tamil.pdfIn PDF document text
    • https://vemubofopelo.weebly.com/uploads/1/3/0/7/130776521/877a293.pdfIn PDF document text
    • https://cdn.sqhk.co/bevoroxur/t1Fgjgc/spectacled_bear_breeding_habitat.pdfIn PDF document text
    • https://cdn.sqhk.co/libobivole/bjejgjb/road_riot_4wd_snes.pdfIn PDF document text
    • http://faguduni.22web.org/nissan_almera_tino_manual_deutsch.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gonafoziguwewe/top_books_to_read_2020_australia.pdfIn PDF document text
    • http://nitusubor.rf.gd/inequalities_on_a_number_line_mathswatch_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/rupatojuko/vegaxojikivotumuxu.pdfIn PDF document text
    • http://litafiwu.epizy.com/queen_bed_sheet_sets_clearance.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/09ec5e88-ecf5-46b7-b73c-21d195e92b1d/30477531703.pdfIn PDF document text
    • https://s3.amazonaws.com/zisulamisozoto/what_can_intercessory_prayer_do.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/259f1489-9c9e-44f0-9b2d-df2adad4990f/football_training_plan.pdfIn PDF document text
    • http://teraropabu.epizy.com/how_to_edit_photos_in_corel_paintshop_pro.pdfIn PDF document text
    • https://s3.amazonaws.com/jepinebawo/life_history_of_great_scientists.pdfIn PDF document text
    • http://xewaditina.epizy.com/2020_nfhs_baseball_rules.pdfIn PDF document text
    • http://pifetipopazemex.rf.gd/xepimavu.pdfIn PDF document text
    • https://s3.amazonaws.com/xukonakefules/clover_pos_system_monthly_fees.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c75151e-d42d-4b95-83a5-087b4804c29d/return_of_service_court_meaning.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c082dce-dad6-457e-bbc2-5449867b185e/xowazagarulutarifow.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010ee0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EE0 4588 bytes
SHA-256: 5029857979d3e74149463335d2629965ffaff20ac20a5dc36a39ceb73cf32113
font_01_sfnt_off00011e8f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E8F 11000 bytes
SHA-256: 072081c480a2e52d398a99e71fbd9ab29f8188162171ffa5eb532f66e7ca73cc

Open this report in the interactive analyzer, or submit your own file for analysis.