Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe74751605871362…

MALICIOUS

PDF

81.8 KB Created: 2021-05-25 08:24:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22
MD5: 9ef2187f8357ec99489c5501bd92db3f SHA-1: 712b7d016deb55fab8183de84e5994447074efa2 SHA-256: fe747516058713629f300d5c2e762a3c0929f22e5c8c3b294a123948bb19a3f6
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/strik?utm_term=how+to+cheat+on+homescapes+level+24 PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4501479/normal_5fe4e79d02775.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408862/normal_5fc6dea9e9f7e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366040/normal_600c00804031d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369651/normal_5fd637b558559.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388427/normal_600d0c91cacba.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449996/normal_5ff10b7e2a66e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366000/normal_60020ae443cbd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4464083/normal_5ff0d2f35c71e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407784/normal_602f093d81868.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4494451/normal_605152600d1b9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4484359/normal_5fde2a2adb795.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444115/normal_603ea5dc659b2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bivanud/41455794853.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/287e0240-c488-4179-946e-752f9d1f8c20/john_deere_x304_parts_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d23b9ac-35d0-480d-8331-746750c73708/18050471951.pdfIn PDF document text
    • https://s3.amazonaws.com/fizaxo/piser.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7252f70c-33fe-44dd-9b2d-911d0014f5ff/history_of_modern_design_david_raizman.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cace1344-5ed1-43ba-82cc-d5eaf34450a6/46725086710.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8381112-6850-429d-91bb-e8eecac3c258/how_do_you_calculate_man_hours_per_day.pdfIn PDF document text
    • https://s3.amazonaws.com/lijopavexanuse/why_was_frankenstein_originally_published_anonymously.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de0ceaeb-1ccd-47b1-addb-7c1a6d701498/how_great_thou_art_sheet_music_chords.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eacb30d5-bf92-4d28-9ceb-2496ae6ad3a8/can_i_use_my_phone_as_apple_tv_remote.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d43e8a38-4ac2-4309-88ab-a22b477c7238/daffynition_decoder_worksheet_page_28.pdfIn PDF document text
    • https://s3.amazonaws.com/regufojalojaza/tijerebelaxiwanave.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53567c93-fb0e-48de-b994-da9d6188d46e/heartstopper_alice_oseman_espaol.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe48.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE48 5408 bytes
SHA-256: 6e86421687ac963126cc76295e174b3a9e6664bf35c68862f1b64997c869ea87
font_01_sfnt_off000110ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x110AD 11968 bytes
SHA-256: fad8164982d775c86f8dc191cf801b5f6b35f8fa5441a083f76e5aaea1ac6fdf

Open this report in the interactive analyzer, or submit your own file for analysis.