PDF static analysis report

Static analysis result for SHA-256 32c8c410040226ef…

SUSPICIOUS

PDF

37.8 KB Created: 2020-11-06 09:46:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: db9e6e70add2bca6fbca4877f11f5d85 SHA-1: 13dc333d615157fe0d7054f8751b32da7f4475a5 SHA-256: 32c8c410040226ef9c01ecd79ae2ee916cad4ba650e1a96efa267e99f807df62
36 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a lure related to game codes, directing the user to a suspicious URL. The ML classifier strongly flagged this PDF as malicious, and an external URI was detected. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the lure suggest a phishing or scam attempt, likely initiated via a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/aws?keyword=rainbow+six+siege+redeem+codes+xbox+one+2019 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4381098/normal_5f9ba775a1f7a.pdfIn PDF document text
    • https://gutomaxitokivi.weebly.com/uploads/1/3/1/3/131383747/501209.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381320/normal_5f8b78c5501ed.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365601/normal_5f872e4dce418.pdfIn PDF document text
    • https://xonujofepip.weebly.com/uploads/1/3/4/3/134385468/mibaxojeva-jobasi-xirofa.pdfIn PDF document text
    • https://xurolimusogisuw.weebly.com/uploads/1/3/4/3/134395808/f36690.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382962/normal_5f8de3e3cc918.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nuxulikiwab/divajajesutonuwisaveruwev.pdfIn PDF document text
    • https://s3.amazonaws.com/wovitiku/unblocked_games_snake.pdfIn PDF document text
    • https://s3.amazonaws.com/dazifozixawus/aislamiento_de_bacillus_thuringiensis.pdfIn PDF document text
    • https://s3.amazonaws.com/remuv/jerusalem_artichoke_health_benefits.pdfIn PDF document text
    • https://s3.amazonaws.com/gofilafixu/turnigy_evolution_pro_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000055b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x55B3 6016 bytes
SHA-256: 4771d4730f2bd5c5cb4ebd2121bd757cb1c896a705ddfb19b010fe98766c3fd2
font_01_sfnt_off00006a2d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6A2D 9448 bytes
SHA-256: d24836a2c0297533f8880687534cefb70992394504aeaabbfcb3cd06eb01a12c