Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f341965b61f0585…

MALICIOUS

PDF

68.1 KB Created: 2020-12-20 05:49:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 993edea07b2a97b671ce2cf2b556be4b SHA-1: 9da931d0d8d912ac0d8e6f346a48dcdf8fee4a39 SHA-256: 0f341965b61f0585af5ce88af372b9180c8bba30e00db1bcf63c6b8702a3657b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=great+lakes+hot+tub+user+manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4368762/normal_5fb5dec6af3d2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500189/normal_5fb4add798829.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471985/normal_5fc7fdd4ee22b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kelukakeb/letter_from_heaven_song_bill_morrissey_lyrics.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec6fd64f-c015-410d-ba1b-f7a0f3b54cb2/4602886288.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42bd566a-7dae-462b-9f5b-df076462e82e/komubafado.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b369a154-c0df-436c-8820-34845fa23e5b/pebapupojedo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e21d258c-c727-4209-b5b3-729924df5239/still_missing_chevy_stevens_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7333ef0f-531c-4bc9-8027-7d9190beffde/fasitodulis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd653330-8c75-4f48-86b4-38384bb37fb5/remoteapp_windows_10_download.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc18074be9b6939510f0b00/t/5fc5aebe4e98326c02d58b04/1606790846200/wodabukok.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fdc826ac3cfda2dcf0aa550/t/5fdd1638ca73133e58121a9d/1608324665366/adobe_xd_software_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/46133bc9-5227-4948-8f4d-e013e733f886/11315088442.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cde5692a-e9d1-4f76-82ab-a8ab54b6754d/38725517312.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4fb28ca5-487b-4e40-bb5a-f1d11748bcf1/amazon_app_store_apkpure.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cde1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCDE1 5160 bytes
SHA-256: 2133eb2818a38862bb5789d0169fc534d06b108b33a05509122122fd432408f1
font_01_sfnt_off0000df45.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF45 10552 bytes
SHA-256: 118e6dcf40f0d1faf40b867e19c1a2106536c740dda676cb85e64758291b61ab

Open this report in the interactive analyzer, or submit your own file for analysis.