Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c3557381427a6bf…

MALICIOUS

PDF

56.5 KB First seen: 2021-10-12
MD5: 19f5ed320910864746f16939b652ba6f SHA-1: 5e5f431e84bb6b17bfed6d5ec0aa63769b11dd00 SHA-256: 1c3557381427a6bf2c50be6bf88a71fb926402280c175f1ca10e23adeed5d189
114 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF is identified as a malicious screenshot lure, designed to trick users into interacting with a link. This link, 'https://adoba-us.online/pdf-viewer-online.rar', directly points to a RAR archive, indicating an attempt to deliver a secondary payload. The ML classifier also flagged this PDF as malicious with a high score.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7904

Heuristics 4

  • PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
    PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 2 text block(s), carries a click-outward action, and is only 56 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://adoba-us.online/pdf-viewer-online.rar In PDF document text
    • https://cdn.discordapp.com/attachments/847360629584560142/894503193483018240/Swift_copy.cabIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/tiff/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdfx/1.3/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_023_off0000dfd6.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0xDFD6 239 bytes
SHA-256: 140faf01021bf596aa28648de25e68f1445fb9ca811027329d16b9a784b5dd55
font_00_cff_off00001c2f.bin pdf-font-stream PDF embedded font (cff) at offset 0x1C2F 2406 bytes
SHA-256: 5c9ad89521f47e0e07e664fedc6615d77049fb80dd2bc2ac56b7ba7d44fe3ae6
font_01_cff_off000026e3.bin pdf-font-stream PDF embedded font (cff) at offset 0x26E3 1242 bytes
SHA-256: 14da413cb0be5ebe6ae0461f1fea41564dd8dcbbb8371b049b1d89e8b7da813f

Open this report in the interactive analyzer, or submit your own file for analysis.