Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5042daafbbc668d…

MALICIOUS

PDF

81.6 KB Created: 2021-03-26 06:14:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 27c75c6e7224b3c56982c12d0170ec22 SHA-1: 95e5f92ccec1f1369a22b23edf376869563af558 SHA-256: f5042daafbbc668d64543570ffe224832df3115b9ff6d6754f124d10e3e5e960
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=free+powerpoint+presentation+slides+template PDF link annotation
    • http://sefobadivura.iblogger.org/83832496846.pdfIn PDF document text
    • http://todayshop.website/11775710311pfws4.pdfIn PDF document text
    • http://mihetos.xyz/346092329313vzyn.pdfIn PDF document text
    • http://arenaprobet.com/rijiwasuwebokiruvo2evzw.pdfIn PDF document text
    • http://meetchat.space/manual_de_borland_c_5._02opnty.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/gozifep/87030760232.pdfIn PDF document text
    • https://s3.amazonaws.com/lanorolowu/locked_out_of_heaven_drum_sheet.pdfIn PDF document text
    • http://mibanuxebom.rf.gd/24414598668.pdfIn PDF document text
    • http://zusaxadixuxot.myartsonline.com/3_times_table_test.pdfIn PDF document text
    • http://ketabigumowun.atwebpages.com/gujufalidupula.pdfIn PDF document text
    • https://s3.amazonaws.com/tapelu/95230990665.pdfIn PDF document text
    • https://s3.amazonaws.com/mexesazaxasa/kusakumunoxas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f18fc6c7-0b91-4f87-8146-fe08ea413fbe/double_list_comprehension_python_example.pdfIn PDF document text
    • http://kepawomokatuke.myartsonline.com/spatial_ability_aptitude_test.pdfIn PDF document text
    • https://s3.amazonaws.com/nelizenejakarug/25692474.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/752925e8-832e-437e-a6e0-7d1b04a010ff/mokofudewakagaze.pdfIn PDF document text
    • http://xixivozute.myartsonline.com/exo_corrig_barycentre.pdfIn PDF document text
    • http://wadoromutisagar.myartsonline.com/58168550453.pdfIn PDF document text
    • https://s3.amazonaws.com/xewamejixolefaj/cribriform_plate_of_ethmoid.pdfIn PDF document text
    • https://s3.amazonaws.com/figugipopar/60581433956.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e323732-ac29-438f-93ea-acbc2d84d99b/19044786680.pdfIn PDF document text
    • https://s3.amazonaws.com/pewibim/akasam_kindiki_vaste_video_song_free.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f63d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF63D 4940 bytes
SHA-256: c62e1b038fb8159bd8ab45f8a303c8fd529d85b9605fed33d2c0ad0957dc3b43
font_01_sfnt_off000106f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106F4 10508 bytes
SHA-256: 13f9f65403d332aa66866f4c98506bd743b6ca8c011e8d252f0dcd2612a958ec
font_02_sfnt_off00012a6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12A6B 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.