Malicious PDF — malware analysis report

Static analysis result for SHA-256 fcfbde81b7cab149…

MALICIOUS

PDF

101.8 KB Created: 2021-04-07 08:30:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 585b716bf8f45c2686c323584be6de86 SHA-1: 60597f20dfdd2b60b3348836412bf41901c1bea8 SHA-256: fcfbde81b7cab149774a9919c072e8574212a637c3bf38873cc6ef5ca62b59aa
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/123?utm_term=real+baby+crying+ringtone PDF link annotation
    • http://vumajuzatijerak.getenjoyment.net/kebasor.pdfIn PDF document text
    • http://hurricane1.space/bojack_horseman_season_1_episode_12_quotesjhja5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417527/normal_605baa098c3e2.pdfIn PDF document text
    • http://busivel.xyz/9369831690izfxo.pdfIn PDF document text
    • http://jotusimemirido.sportsontheweb.net/42234609528.pdfIn PDF document text
    • http://daliadiago.com/rafufitalotaf16ey.pdfIn PDF document text
    • http://kokolonesafu.getenjoyment.net/nataxetemefakigiwom.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408707/normal_6011b780f108e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465250/normal_60549f0d60eae.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471941/normal_5fcd138c1c357.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457861/normal_602e03047a572.pdfIn PDF document text
    • http://ridunculus.com/110958233593zqi8.pdfIn PDF document text
    • http://polfact.site/how_to_turn_off_door_ajar_alarm_on_frigidaire_freezer1gvlv.pdfIn PDF document text
    • http://mexicotop.xyz/befutawot51gf.pdfIn PDF document text
    • http://mavito.online/march_assist_app22mz4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dubiditiginowo/mawikonopibaluzifipawapi.pdfIn PDF document text
    • http://zeteximezoxa.myartsonline.com/risk_based_internal_audit_report.pdfIn PDF document text
    • http://wukevivetarapu.myartsonline.com/20633008558.pdfIn PDF document text
    • https://s3.amazonaws.com/nunakixuma/sokenezemepo.pdfIn PDF document text
    • https://s3.amazonaws.com/bejikefowu/75917540836.pdfIn PDF document text
    • http://solezod.myartsonline.com/ken_liu_paper_menagerie_quotes.pdfIn PDF document text
    • https://s3.amazonaws.com/bejexe/stained_glass_window_project_algebra_1_answer_key.pdfIn PDF document text
    • https://s3.amazonaws.com/xunilukegez/bit.ly_goodnight_gorilla_film.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012a62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12A62 3396 bytes
SHA-256: ac0cf924d68a1b188a98fc5ceec17e938bea71c2a2bb86d03ad2223813d71e38
font_01_sfnt_off00013679.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13679 5036 bytes
SHA-256: ab42749a44719e0c931dbc8492eea9521d3d5119dd85e729e4bf5a9d405b02d5
font_02_sfnt_off000147bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x147BF 13820 bytes
SHA-256: 6f27c7b2284a84866e577d96e2745bb67592ce2f991e8c6b42bf1cf1468bda7c
font_03_sfnt_off000172b0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x172B0 16092 bytes
SHA-256: 39b2f4b99ee08965fd4836f89f628a00cde8346cb181131bba0308e80db8fb67

Open this report in the interactive analyzer, or submit your own file for analysis.