Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d033e9c1da22d75…

MALICIOUS

PDF

59.8 KB Created: 2020-12-23 04:43:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 0d5694221a2dbc39ddea246fad753596 SHA-1: eda35b2f8344787ba7c55e0ceee41860e12f0108 SHA-256: 1d033e9c1da22d75c5e89376fbf988dcf00f20c922a958ca9b1530c15aecf0fc
116 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a callback-phone (TOAD) lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=south+vietnam+flag+lapel+pins PDF link annotation
    • https://sewobefavewekog.weebly.com/uploads/1/3/4/3/134367647/6839962.pdfIn PDF document text
    • https://kokarino.weebly.com/uploads/1/3/5/2/135299240/januniwekubarejijew.pdfIn PDF document text
    • https://bejelubizibo.weebly.com/uploads/1/3/4/8/134870507/9489397.pdfIn PDF document text
    • https://bolififona.weebly.com/uploads/1/3/4/3/134316640/jipezen-rekafebi-sifoxiwope-kavugoremevik.pdfIn PDF document text
    • https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/roriturosiw.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381788/normal_5fbff298ec560.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/4dba00a1-b47c-49d8-a6ef-99d3271e9a27/54317397415.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c2b61f3-8668-4671-bf16-1e94b288b5dd/cleanse_totem_dead_by_daylight.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c44998e-6216-4a75-bb35-cb0be0fb033b/mipubebusekezijipun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/72f9807c-c08e-4a5f-b382-968b6cb5ad9b/nezevizipivonalewanuve.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56220f70-ab94-4e4c-ac3a-3c065b8d22b8/86116203768.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66f6d99a-12e6-4f9d-97ca-a516bc7a5d59/high_school_dxd_special.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bfc89825-cd69-4c07-bc70-041b9be03690/bawadosijatotofaji.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000acfb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xACFB 5380 bytes
SHA-256: b5db503224c1d92f4b38aba4215c768d30aa1fe470b31c191f1c174aa0deb81f
font_01_sfnt_off0000bf34.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBF34 9936 bytes
SHA-256: 8f6fa39900862694bd51d8e110cbc8eaeed08deb906635a85020412b2559647b

Open this report in the interactive analyzer, or submit your own file for analysis.