PDF static analysis report

Static analysis result for SHA-256 13753cbdcc3fc807…

SUSPICIOUS

PDF

69.6 KB Created: 2020-11-06 00:26:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 1d017dd029caf2b5666036cbb9273f80 SHA-1: 272de91861d4777481f46e75e6968f27e50b63dc SHA-256: 13753cbdcc3fc807289dce769613dc409c60a856ddd3af584be7860851e08be8
36 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as suspicious by an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?keyword=american+dad+watch+cartoons+online+season+12 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4405208/normal_5f9188167592b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369933/normal_5f89d34355a6b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445869/normal_5fa24a9227123.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411915/normal_5fa2f5e98ad2b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378171/normal_5f91c59c17e70.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427809/normal_5f9ccfe6a8321.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369917/normal_5f91da12330b8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365536/normal_5f8c738a72a4b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424330/normal_5f9dd54ec1242.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377656/normal_5f8ef77858878.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454971/normal_5fa076495a21c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379035/normal_5f93a860cd3dd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375356/normal_5f93060b25e00.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387219/normal_5f9c966b0a5d9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/9dedd767-e811-4234-a9e4-00771940f6e4/64534893888.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1d76f5e-9009-4e42-ad98-9782434aeed0/zororaxufunirelin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3555aa56-d23c-4d6b-837f-e670e725c619/61066580919.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008001.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8001 14664 bytes
SHA-256: fd8cbcc654120d62c0008ffa78e8fa6895c702dcbf557632270225c0ccc33a31
font_01_sfnt_off0000af84.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAF84 5232 bytes
SHA-256: da0e7434545ce16e266ac4e5359968d544c147fd770f6f6ae91aea300926c617
font_02_sfnt_off0000c11c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC11C 10504 bytes
SHA-256: 9b68bc3a2c8fb3582e41510be147cddbb946df5361ed5da6ca5392ea4656d923
font_03_sfnt_off0000e4fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE4FC 16092 bytes
SHA-256: b5f0b32f6543351256b73815f81a040120bd033010e1d2e1258d4bc00aa53fb6
font_04_sfnt_off0000f9b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9B9 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.