Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa75c7a1ed799ebd…

MALICIOUS

PDF

75.9 KB Created: 2021-04-08 02:18:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 380bb220b6168ead669e7fcaa022324d SHA-1: 90c5bd22a993557f97e4093e89bd493fc956832e SHA-256: fa75c7a1ed799ebd76412f26dac1ae9a4b3a27de6d32fcd34a86fa8798b22a52
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=behringer+v-amp+2+manual+pdf PDF link annotation
    • https://jugefisofewutep.weebly.com/uploads/1/3/4/3/134368120/40054c4def385.pdfIn PDF document text
    • https://cdn.sqhk.co/nabaxifow/ea4igjf/dobogunosujusiguro.pdfIn PDF document text
    • https://sewogasi.weebly.com/uploads/1/3/1/1/131163712/8494109.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418558/normal_6019b72718f69.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417998/normal_60682e15e34bc.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4428062/normal_5ffba87e45c44.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4388040/normal_60076baa9d0d0.pdfIn PDF document text
    • https://cdn.sqhk.co/dinigivo/jihcwaK/rakeridilukatowubevo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444882/normal_6002033557f23.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4503617/normal_606e03ceca7c3.pdfIn PDF document text
    • https://cdn.sqhk.co/nivunufozub/ighgYie/ark_survival_evolved.pdfIn PDF document text
    • https://cdn.sqhk.co/siripeka/ie1hbMU/music_player_device_android.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489717/normal_6043e30ea17f5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416664/normal_600f8c237b4ea.pdfIn PDF document text
    • https://cdn.sqhk.co/kajurineg/hcjbghy/sweet_fruit_candy_game_download_for_pc.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b7becf8e-fbdc-4aba-93e0-07b6783b1829/zebasopemo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/05462dd6-32d8-4e58-a5d0-87502ba73cd1/directv_remote_control_fire_tv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/069bd0de-61b6-454c-846e-b3e2c63e10d1/mobylette_peugeot_103_rcx__vendre.pdfIn PDF document text
    • https://s3.amazonaws.com/bokofapig/axillary_bud_plant_information.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4178a9a6-2102-4169-9ab5-a26d67ef3f65/katawa_shoujo_map.pdfIn PDF document text
    • https://s3.amazonaws.com/bulolimepol/pci_compliance_reporting_requirements.pdfIn PDF document text
    • https://s3.amazonaws.com/zodererezuzuxi/11944320122.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02ebbed6-75ae-4a79-8555-d9d2b81786ce/83437052419.pdfIn PDF document text
    • https://s3.amazonaws.com/wiwamoxamo/water_cycle_worksheet_grade_5.pdfIn PDF document text
    • https://s3.amazonaws.com/fukepez/xolusaxakuzijebiwodigeri.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e85e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE85E 5552 bytes
SHA-256: 84e80356bd965ee9df85106049693cd1073b8604c7fbed945ccb6ee199bf64eb
font_01_sfnt_off0000fb2b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB2B 11180 bytes
SHA-256: fd5e931c2cdb81c1ecb6c3b9bff12392d37fdad8ed2d2d8c3dceeb3ce4fc56b3

Open this report in the interactive analyzer, or submit your own file for analysis.