Malicious PDF — malware analysis report

Static analysis result for SHA-256 41c71b41e807005f…

MALICIOUS

PDF

79.6 KB Created: 2020-12-27 15:58:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 5f65c5e40d2d1a8bb4d42ae624fc58f5 SHA-1: 4ca59baa33e2bd7d2cbdabb6d1b27eb981734722 SHA-256: 41c71b41e807005fad7c76ec82a6d2423547132b05276979350041e0af8a1669
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, masquerading as a wallpaper download. This URL, combined with the ML classifier and ClamAV detection, strongly suggests a phishing or malware distribution attempt. No scripts were extracted, but the presence of an external URI and the overall malicious classification indicate a likely spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/strik?utm_term=iphone+11+pro+space+gray+wallpaper PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4491687/normal_5fe197822bbbe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367950/normal_5f96f1e6a3a17.pdfIn PDF document text
    • https://jurefuzosapob.weebly.com/uploads/1/3/4/9/134901670/votagoda.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408479/normal_5faf17d707a6e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485166/normal_5fc445d6ef381.pdfIn PDF document text
    • https://vodiwisilob.weebly.com/uploads/1/3/2/6/132681054/7841890.pdfIn PDF document text
    • https://nirodafudo.weebly.com/uploads/1/3/4/6/134697392/fa94d5cfbeda.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421770/normal_5fbc2acd509f9.pdfIn PDF document text
    • http://www.typoland.com/http://www.typoland.com/designers/Lukasz_Dziedzic/CopyrightIn PDF document text
    • http://www.typoland.com/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.orgThisIn PDF document text
    • https://uploads.strikinglycdn.com/files/46e4e412-3d16-4d1e-93f0-07c7413f0118/92422837863.pdfIn PDF document text
    • https://s3.amazonaws.com/xonaxevetaf/16751876557.pdfIn PDF document text
    • https://s3.amazonaws.com/jazamerijekufol/epa_fuel_economy_guide_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/werowibovezoje/ulcerative_colitis_treatment_guidelines.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://scripts.sil.org/In PDF document text
    • http://scripts.sil.org/OFLAbyssinicaIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bc97.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBC97 3904 bytes
SHA-256: 53b300a6b6db263a06fd517a79b820e7a3f6698dce9e727308b24b3509ddf913
font_01_sfnt_off0000ca34.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCA34 6168 bytes
SHA-256: 50bd8db5ff9a0f03ea6ac0366ab4ff273dceb6ff0c6101ac0faff1fd52ccc92d
font_02_sfnt_off0000d9d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD9D6 5376 bytes
SHA-256: 1759cf91020c788fdfedde2c97c04b98d487b923d69bd7e72fac0f892f988d68
font_03_sfnt_off0000ec35.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC35 20632 bytes
SHA-256: f674a73fbb8685d72d5504ad052566457fab642103ef53d4897d7de6f173adbd
font_04_sfnt_off00010b15.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B15 10988 bytes
SHA-256: 26b553da44507fb25c97d15dc5180a4c2c67de4f9f8108317df21ef99754f927

Open this report in the interactive analyzer, or submit your own file for analysis.