Malicious PDF — malware analysis report

Static analysis result for SHA-256 1908fdcf5bf5dd1d…

MALICIOUS

PDF

73.2 KB Created: 2020-12-11 18:37:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 50c48bcf19a9ed00c4e3be4edbfd2249 SHA-1: 06812543c8a70098edf25e0543403e382c830824 SHA-256: 1908fdcf5bf5dd1d6e610366a2df1a4cd089a4d29801323a88c66b81daded02d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/strik?utm_term=sharp+tv+remote+app PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4484610/normal_5fb2d863203e9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419002/normal_5fcbb37ad2384.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380380/normal_5fa52e054f405.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418167/normal_5f9b1bdbddca7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e6c9379-c4cf-48f3-bcbe-9b563167e641/77207108058.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf157b7ee8e70759d48e3/1606218073026/losor.pdfIn PDF document text
    • https://s3.amazonaws.com/jufowokedunod/pimula.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4fc43f75b16643cbb46c/1606373317743/denon_avr-x4000_reset.pdfIn PDF document text
    • https://s3.amazonaws.com/ratixifo/7864513494.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5e76b66-e2f6-4e43-9783-a7f4266fb00f/pool_rules_scratch_on_black_ball.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0b334885-3caf-48a9-b195-41ba7ea02d3a/zolivisigovalufop.pdfIn PDF document text
    • https://s3.amazonaws.com/wibedubosateg/pdf_watermark_creator_app.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af7df9ff-a67a-483c-b113-e57405729587/shounen-ai_anime_on_hulu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c575299d-76f5-42cc-a0ae-d4d5a5c0badd/jifiwuba.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc58cd0085bf90c0e1cb067/t/5fc60271a97599144ec7976b/1606812273568/water_wheel_falls_fishing.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcefc464a3cc4058a337ce/1606217669032/wibiwetedalerop.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000be1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBE1A 5012 bytes
SHA-256: 727d6edd09aeed0428182de2281fc1ff3375eec2a279b5cb12d92864d4ee6654
font_01_sfnt_off0000cf00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCF00 5224 bytes
SHA-256: 8a22ec9ce036985ff25157c2d62fdb43872d38bce363a15dee84750f7a75050a
font_02_sfnt_off0000ddc4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDC4 10256 bytes
SHA-256: a6bbb01de8357c610fc4ccde734026553916176a61634f94d6d68c64d12867c5
font_03_sfnt_off0001012a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1012A 16544 bytes
SHA-256: c64f975c7c74378765a15e192890ba001b575443647995d4109c17b56814fb1e

Open this report in the interactive analyzer, or submit your own file for analysis.