Malicious PDF — malware analysis report

Static analysis result for SHA-256 fafd3941f9b54a0b…

MALICIOUS

PDF

86.2 KB Created: 2021-03-15 05:43:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 428d51fc476a1b5ca6f164bb5e767bae SHA-1: a4df4ef785e6d7181eda4526967abf461ba2217c SHA-256: fafd3941f9b54a0b363411993b445071ea43c3be7deccd4ba040c3adff3b7c1f
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=lg+v20+screen+replacement+guide PDF link annotation
    • http://iranomics.com/chief_accountant_cvqccra.pdfIn PDF document text
    • http://help-violation.com/daffynition_decoder_answer_key_page_121qg6wo.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4491965/normal_5ff24ebc869ed.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4491686/normal_6008cdc91bb7d.pdfIn PDF document text
    • http://lofitner.buzz/amsco_apush_chapter_15_short_answer_questionsxk915.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476432/normal_600da3ca91bf8.pdfIn PDF document text
    • http://doucheapp.xyz/37225967928wdol7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374843/normal_603d3e1db2367.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454182/normal_6018a5b36408c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4499329/normal_5fdfa8a29249d.pdfIn PDF document text
    • http://insta-sale.site/how_are_kinetic_and_potential_energy_relatedcbyin.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484609/normal_6022ba99af379.pdfIn PDF document text
    • http://cardio-natural.info/marine_safety_center_ballast_water5hy35.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386363/normal_601712029783c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/werowibovezoje/85092322965.pdfIn PDF document text
    • https://s3.amazonaws.com/jemazejodep/lovely_noor_all_song_djpunjab.pdfIn PDF document text
    • https://s3.amazonaws.com/vizegemawokaxe/giwixinekukomusunil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20051d9a-f27f-4b2a-a96f-697c45702c0c/dazubibulolol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/99434349-62c0-49ba-b9be-18e8cf3d41ec/list_of_roman_numerals_numbers_1-1000.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82bea011-71f2-42e5-8af7-6d4e65b4deb2/grammaire_progressive_du_francais_corriges_download.pdfIn PDF document text
    • https://s3.amazonaws.com/fosalizuzu/basler_electric_transformer_120v.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/58c3f4aa-7c57-4b27-9057-1df80dbebe9b/50163440492.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011427.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11427 5668 bytes
SHA-256: 7ecab1dcee0169107a8c997cef3e1944f36935a681f6a88fc4f4131fbb2aa12b
font_01_sfnt_off00012770.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12770 10896 bytes
SHA-256: cc7ae8bb77cc703fb95c3e6ed0bca8b309e3c3bde04791b1f902c03bb7fe7278

Open this report in the interactive analyzer, or submit your own file for analysis.