Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9eda2c557b62980…

MALICIOUS

PDF

73.4 KB Created: 2021-03-10 19:37:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 2b85504d6d71372d9619c9a5b9ab92af SHA-1: bd7d52e491ed98472b8f5a30bb8dc6dff7159399 SHA-256: f9eda2c557b629802295fab9c7f205214dd1ca7131f46f76e39a87b1281c3a46
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=spatial+data+analysis+pdf PDF link annotation
    • https://cdn.sqhk.co/loganidob/cheEJQs/packers_bears_score_prediction.pdfIn PDF document text
    • https://cdn.sqhk.co/bidekidarub/QjerXhc/kizerokiderokesisuxeleda.pdfIn PDF document text
    • https://cdn.sqhk.co/xoberuweri/gh2khhb/osu_help_desk_phone_number.pdfIn PDF document text
    • https://cdn.sqhk.co/vanewano/ojcdhbu/cute_tie_dye_patterns_diy.pdfIn PDF document text
    • http://giocodigital.space/882834705467d7u1.pdfIn PDF document text
    • https://cdn.sqhk.co/monazaxumol/h7o3Xjb/34510709525.pdfIn PDF document text
    • https://cdn.sqhk.co/gitovera/iuwWjgR/maxixakugatek.pdfIn PDF document text
    • https://cdn.sqhk.co/pedidagow/ghbhejg/history_and_history_of_art_edinburgh.pdfIn PDF document text
    • https://cdn.sqhk.co/suwixowefa/iidWijg/59382878419.pdfIn PDF document text
    • https://cdn.sqhk.co/dojoxuwote/hgi3Xhf/96235757012.pdfIn PDF document text
    • https://cdn.sqhk.co/widexerun/gjEAQgd/terazuve.pdfIn PDF document text
    • http://ekzo-fruit.ru/delhi_belly_movie_ringtones_free4ysr0.pdfIn PDF document text
    • https://cdn.sqhk.co/kotoweraga/8jfGJgj/huawei_airtel_4g_hotspot_app.pdfIn PDF document text
    • http://my-favshoph.online/the_norton_anthology_of_african_american_literature_third_editionoj6l2.pdfIn PDF document text
    • https://cdn.sqhk.co/tosuwukiwate/wLidrhj/80554725693.pdfIn PDF document text
    • https://cdn.sqhk.co/zatovafer/sKih7ij/bottle_flip_3d_poki.pdfIn PDF document text
    • https://cdn.sqhk.co/rozamulev/fhcsBOG/candy_crush_saga_level_5326.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6ff9b63c-a503-44c7-ae02-bc47112e9f3f/jafupidosowidolabamal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/182659a2-9f77-4787-ad3b-5afada4cc193/fewujoluresukixokipin.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e394.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE394 5144 bytes
SHA-256: c366f36c6afa49ea89bd09ac82d420fc024d16a66167eabb03a68f3a0b4436a0
font_01_sfnt_off0000f533.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF533 10424 bytes
SHA-256: d23874646175b37c6184573b89cb1e9813379f5d7aa66273450c9654b6c9bfd0

Open this report in the interactive analyzer, or submit your own file for analysis.