Malicious PDF — malware analysis report

Static analysis result for SHA-256 f07130517a8c7eac…

MALICIOUS

PDF

82.4 KB Created: 2021-06-07 00:13:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 2c1f836664d50a27f6abbaf395096bd8 SHA-1: b07659a99ab39aa8163074f965e454336e977572 SHA-256: f07130517a8c7eacffd89eebf3dd1a47e359a5479a32f8b6e9b18a07102cae55
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/pbw?utm_term=fast+and+furious+6+sub+indonesia+full+movie PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e55684f-e3c1-4f9d-83dc-e95efcfb3535/badger_5_garbage_disposal_replacement_parts.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e7cc3bb1-a0a4-4d25-8f3a-d9efc066adca/adobe_photoshop_cs3_video_tutorials_for_beginners.pdfIn PDF document text
    • http://mibegenav.pbworks.com/f/what_does_error_9_mean_on_accu-chek_aviva.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0730030d-0657-48ed-847a-3ddbb108e67d/ginexaruronan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b635b25-2cf2-4a45-ae83-036dea3cc7e7/lobimefekubevabepire.pdfIn PDF document text
    • http://bemulopawed.pbworks.com/f/54651884924.pdfIn PDF document text
    • http://dagomiwavi.pbworks.com/f/suvipin.pdfIn PDF document text
    • http://silasofinat.pbworks.com/f/ansys_fluent_user_guide_19.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81177832-fb61-44a6-b0cd-64286db9e30c/define_derivational_affix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/03a4da94-ca13-49f5-acc5-caa7def326fc/tudugaxafivokuki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c8153033-f29e-49ef-ab60-d88932dc1e51/confederacy_of_dunces_chapter_14.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91e83dd7-cef3-4736-be7d-1b8a2ea6ad7c/93461189780.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f254a099-2204-4f6a-ba12-5e7487651c5c/audio_technica_lp60xusb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/28115184-673e-4cdc-a813-823433735140/leo_strauss_and_joseph_cropsey_history_of_political_philosophy.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de95ccfa-a341-48d5-9eff-1b76ab2ad301/xuzevigusobugisesaz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/461f4ad4-8ec8-45ef-98ee-4b9fcbd0b430/1048867923.pdfIn PDF document text
    • http://bofamawetodo.pbworks.com/f/ozark_trail_canopy_installation.pdfIn PDF document text
    • http://bezawagiga.pbworks.com/f/libro_la_ultima_oportunidad_carlos_cuauhtemoc_sanchez.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e960.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE960 5364 bytes
SHA-256: e0cc8cbc2eea9c4c6b380365b8bcee2e7b7f299e128267a88b5f038d45cc8d72
font_01_sfnt_off0000fb87.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB87 12484 bytes
SHA-256: 50ae0c39eba716201c182f242d9a4daa7996d9afae146fd17f0a209b7a536481
font_02_sfnt_off00012471.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12471 16208 bytes
SHA-256: f76e53b1165c770ea72ceccb5e808e1d48d2b426d0b5e274530350a00bad707e

Open this report in the interactive analyzer, or submit your own file for analysis.