Malicious PDF — malware analysis report

Static analysis result for SHA-256 3dd63b40570ef3b2…

MALICIOUS

PDF

61.2 KB Created: 2020-12-31 17:55:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: e612751dcb1ff119591d638e4d6c2084 SHA-1: 0c34af2a8eecf499f43ce04ae018356ce0db1ad6 SHA-256: 3dd63b40570ef3b2d00d1cfc3196e27b037f2059b74cce89563a181daf3b383c
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. An embedded URI points to a suspicious domain, likely for credential harvesting or malware distribution. No scripts were extracted, but the PDF structure itself likely contains obfuscated JavaScript to facilitate the malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7689

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=marshmello+dj+wallpaper+hd+iphone PDF link annotation
    • https://cdn.sqhk.co/sisadenev/I24HhdL/sky_force_reloaded_card_hunting.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4492892/normal_5fae479cb28c0.pdfIn PDF document text
    • https://mumixopid.weebly.com/uploads/1/3/1/8/131872042/5470078.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411479/normal_5f95bd24a52ac.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374860/normal_5fa59f3aabdd8.pdfIn PDF document text
    • https://sogatetemurus.weebly.com/uploads/1/3/4/3/134379625/9028787.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376866/normal_5f94253ac986e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jivamubug/99188315760.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c8577d97-4322-4aa9-9d3d-ed951a0bd86a/68503502802.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ffcfe58e-3daf-4e96-915a-25e02a5dd38a/yamaha_breeze_125_manual_free_downlo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90a3f168-7a30-4979-b17f-c19964fc2128/american_casino_guide_2019_las_vegas.pdfIn PDF document text
    • https://s3.amazonaws.com/juvosi/tedavolipupeporovikerusu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3edddde3-a523-4526-8b3b-1db366571200/vaguzalofesusunasigeguna.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d327.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD327 5372 bytes
SHA-256: f93a86745e0377e4f051d3d0da7450d2173a0d80b1c69260852023f1c98a7eed

Open this report in the interactive analyzer, or submit your own file for analysis.