Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdb987e7b8185c33…

MALICIOUS

PDF

82.2 KB Created: 2021-03-15 20:42:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24
MD5: 2ebe82878168d53df199e5131a88ae81 SHA-1: 3811c3a7d727e2522f0a38d37b2aada898a428f3 SHA-256: fdb987e7b8185c33ffd70ea0f3621aa8f2511ec88c1b136b6a422ed05d7df23d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/wix?keyword=can+i+get+car+insurance+with+suspended+license PDF link annotation
    • http://rorogudadusosej.getenjoyment.net/73999937529.pdfIn PDF document text
    • http://fizarumokugafu.mywebcommunity.org/wizebedapujewegobi.pdfIn PDF document text
    • http://dazinifuxevoji.22web.org/bilaspur_up_weather_report.pdfIn PDF document text
    • http://rezonansmusic.com/79579675301rs4hc.pdfIn PDF document text
    • http://nubolats.xyz/65395793252jhjgg.pdfIn PDF document text
    • http://islta.fun/plan_y_programa_de_estudios_2011_primaria_segundo_grados1jhf.pdfIn PDF document text
    • http://xatovapotogu.mywebcommunity.org/what_is_business_report_format.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/patilawasu/15986968253.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6eddd27d-c88e-4b05-8be7-11e7e81d64ff/basic_math_skills_test_for_employment.pdfIn PDF document text
    • https://s3.amazonaws.com/tapelu/vimexoredosanovipev.pdfIn PDF document text
    • https://s3.amazonaws.com/pavujiniz/watermark_adobe_xi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/86fe0c85-8e47-4584-af05-9fc12035a840/modernist_cuisine_gallery_snowflakes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7eed6823-b815-4cc3-9e4c-6d4d55531b5d/how_to_help_black_hair_grow.pdfIn PDF document text
    • https://s3.amazonaws.com/jubiferekaka/ministers_black_veil_setting.pdfIn PDF document text
    • http://sobogasitizi.epizy.com/tibagojafirumokegali.pdfIn PDF document text
    • https://s3.amazonaws.com/bovenotojitowe/pdf_splitter_and_merger_software_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ceb115d9-39f5-4c02-bdd9-9c046527f532/add_second_edition_character_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/saxefi/list_of_teaching_methods_in_primary_schools.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ea036ca-4672-4d42-8c12-225dd102d89c/gimelowanepefag.pdfIn PDF document text
    • https://s3.amazonaws.com/bisapovepizaj/htc_m8_mini_price_in_nigeria.pdfIn PDF document text
    • https://s3.amazonaws.com/bulolimepol/free_printable_maths_worksheets_for_preschool.pdfIn PDF document text
    • https://s3.amazonaws.com/nufidibodudulad/762360152.pdfIn PDF document text
    • http://jalebuvubo.myartsonline.com/coleman_mach_rv_air_conditioner_installation.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001028f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1028F 5332 bytes
SHA-256: 7cd3b6c1b2ed656416109b194137304910cf5bf43b7e71e6422341c9b051cf90
font_01_sfnt_off000114ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x114BA 11296 bytes
SHA-256: 8449e0adfa8d3738488ec92445f34dbf0b28c93d030ab4ca9c3b2cdd45076c27

Open this report in the interactive analyzer, or submit your own file for analysis.