Malicious PDF — malware analysis report

Static analysis result for SHA-256 3759441c03a0004a…

MALICIOUS

PDF

74.2 KB Created: 2021-01-06 04:41:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: dc6606e0b587ecc1d006c6130627c3ca SHA-1: 8853d60d6bcc094c33f271ecf8b67aadfb27c77e SHA-256: 3759441c03a0004a3ebfffaebfac3f40d18f03a4389a07cbc78dfb76ccdf7449
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a link to a known malicious redirector, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. The embedded URL is the primary indicator of compromise, likely leading to a phishing page or a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?utm_term=social+studies+8th+grade+study+guide In PDF document text
    • https://cdn-cms.f-static.net/uploads/4458122/normal_5fbd91d96bd3b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4459628/normal_5fcc5de8c9949.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4444369/normal_5f9fba639a24a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453734/normal_5fc6703c45848.pdfIn PDF document text
    • https://cdn.sqhk.co/sebazisop/hc2hhAC/rajijek.pdfIn PDF document text
    • https://cdn.sqhk.co/wevexifimur/jDFjdUx/tengai_makyou_ziria_xbox_360_iso.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406202/normal_5fc3614a90919.pdfIn PDF document text
    • https://cdn.sqhk.co/wafasojudo/SSUijgQ/82655750619.pdfIn PDF document text
    • https://cdn.sqhk.co/perigupa/egj9bjh/30074926748.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4402504/normal_5fc51bfe231a9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4448724/normal_5fb2acbf0b5b4.pdfIn PDF document text
    • https://cdn.sqhk.co/xinulezebi/joUjhhf/27518130234.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d2642c8-7d5f-4d14-8fc8-507667ce699b/41212404953.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/49a34dff-afb3-4e89-90b0-c06597d8ed33/jibinuki.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e547.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE547 5600 bytes
SHA-256: 872daeb3f584184a998e1760084ce6a1cadc15526821398f0def589dbeb6ab4d
font_01_sfnt_off0000f84e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF84E 10472 bytes
SHA-256: 7b76db9774f52fd4a37fe95385e57cc6c1484a22ac3ff06f33ca78e6f279d1f1

Open this report in the interactive analyzer, or submit your own file for analysis.