Malicious PDF — malware analysis report

Static analysis result for SHA-256 3be9bf3bfae1c76e…

MALICIOUS

PDF

66.9 KB Created: 2020-12-06 15:52:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 10035103789d5fc2aca24c1ff0c22828 SHA-1: abc8693f196e4c2cd8a9d8ff2143e690c7a022c4 SHA-256: 3be9bf3bfae1c76e7ea50b2f4898bcc806c0b74dcc6171a515655dda1f0be9c6
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier and ClamAV also flagged this file as malicious. The embedded URL is likely intended to lead the user to a phishing or malware distribution site, disguised as a service manual.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=mercury+mercruiser+4.3+service+manual In PDF document text
    • https://cdn-cms.f-static.net/uploads/4467577/normal_5fc1de2e7d686.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/megulu/kiguxalulure.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc30b2524b06a7eb30d4f82/t/5fc66d20145a8629dc8e3e4e/1606839585601/dragon_warrior_2_sword_of_destruction.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8d42bbb5-b86f-4c1f-9da0-1fb804ff2844/kiligurimoremurovetewal.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5a91a3dfdd95b60f59239/t/5fcb1b638dcc5603beeef569/1607146340361/metasenasa.pdfIn PDF document text
    • https://s3.amazonaws.com/ronatiduzoxij/30358970273.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/33c060e8-a386-47e5-b525-3bf5037161e3/showbox_apk_working_again.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf3dad334513fae413385/1606218717783/historia_de_la_iglesia_catolica_para_nios.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc3b7d50a2757459bf48cbe/t/5fcbe84f1880ce05e858548e/1607198799452/71453861293.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0cdab3398ff75152d912c/t/5fc38a3af3de5e49b5d1c2b0/1606650427832/muridumakobotar.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c862.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC862 5396 bytes
SHA-256: 272d86e7f09b7197f5d37464748061e60a0672084ef50e7f06301d902979b014
font_01_sfnt_off0000dac9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAC9 10588 bytes
SHA-256: 56a3d22545dc688e30310dcc32e6c111ae24d0a4d0f63f559aeb129d5c56b914

Open this report in the interactive analyzer, or submit your own file for analysis.