Malicious PDF — malware analysis report

Static analysis result for SHA-256 4de0663fb7b95d58…

MALICIOUS

PDF

66.0 KB Created: 2020-11-10 14:50:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: a28226f491f09d6e68f474be85d2f2d6 SHA-1: 16cbadeb6c16717c017315f9e64d8aa8cea02b64 SHA-256: 4de0663fb7b95d58b67eecb53b6eb921f332cd478dd65bd24322db544186323a
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link disguised as a sales advertisement for opals, directing users to a malicious URL. This is a common phishing tactic to trick users into visiting a compromised site. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/strik?keyword=andamooka+opal+for+sale In PDF document text
    • https://cdn-cms.f-static.net/uploads/4401505/normal_5fa17aee5e0be.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376619/normal_5f8fbcc48e1ff.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392220/normal_5fa434869dc15.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379961/normal_5f9ab4af0a0da.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378599/normal_5fa0dc1a9c39d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4466411/normal_5fa7621e3e214.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/retobifulipo/tommy_emmanuel_amazing_grace_tab.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a074cb5a-a437-400a-bbaa-8db2ffbcaca2/fufepupep.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0123bfcd-83a8-4c30-ba8d-9c0d4eb919ed/the_last_dragon_gacha_life.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70281995-5640-4a23-af34-d469112663e4/26174845256.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31f5a387-422a-4ea0-98a5-120252d02705/73701277880.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77a21b18-a2cd-4c35-bfd7-bc0a8081792c/55186378805.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ffb1d2fe-c944-4eee-a2f5-e77ef801f51a/nediniduboboviwabenini.pdfIn PDF document text
    • https://s3.amazonaws.com/debamijizozexo/72755754255.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bac0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBAC0 5240 bytes
SHA-256: 7dffbb9543af7cd82b208756450daabc2cd770838948a7c0a1e5f76966830fe7
font_01_sfnt_off0000cc7a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC7A 2140 bytes
SHA-256: 49dddaa543544930169c80d10742cf71a10a90771d945bdf421e53748b1fa594
font_02_sfnt_off0000d654.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD654 10828 bytes
SHA-256: ebec47a0b5c140b6e7222d28d18de25dd929b548dc2c32fc91cda2c22064fd6e

Open this report in the interactive analyzer, or submit your own file for analysis.