Malicious PDF — malware analysis report

Static analysis result for SHA-256 5699f9df78e6beac…

MALICIOUS

PDF

74.5 KB Created: 2020-12-17 03:20:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 8e9169241b5c00da102148184cf7e958 SHA-1: 9e4366060b99cefb1a78dd5944c7cd2ea2e604d0 SHA-256: 5699f9df78e6beac6d36ffeb58bd63802f8c057988994217a11ad92fcf851fdb
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, likely intended for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to product specifications.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/strik?utm_term=yamaha+yas-103+specs PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4373301/normal_5f893a63a1dd1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370055/normal_5fbeecefc59cd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367632/normal_5f908ff12dc57.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379973/normal_5f9486d9a7250.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc6d72b0d716e027b00323d/t/5fcb6daa6fd93023bc04c763/1607167402882/kujosewozakisapisiseno.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc79e65579eee3ae06ed292/t/5fc8904f43b29e7a5af908e0/1606979664694/falekujurogadejuf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90d03378-f615-47e8-b3fc-b2b1e26935cd/mo_willems_books_in_order.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc14748c89e1c4b8fc0f61a/t/5fc98d81e4017829c161f6d8/1607044481985/kasparov_freestyle_chess.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb065407-7576-417d-8849-eb7bae2f4388/honkai_impact_3_mod_apk_obb.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc101f96609fd0ee791e489/t/5fc1e0d04f983757202439bd/1606541521101/lost_knife_hideout.pdfIn PDF document text
    • https://s3.amazonaws.com/fejenijovekozu/58429437318.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5453dd49dd12447511837/t/5fc84cb5ee804a17a1ccd64a/1606962359396/19420140123.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e51c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE51C 5496 bytes
SHA-256: 7870cd89b356f602d6eefa7866e5e0c7ed8da0c37bd66d98ec3968961f956315
font_01_sfnt_off0000f7c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7C3 10576 bytes
SHA-256: 276903df6758b221823657b67a71e48225468d3a19147006d66aac7e13e4ff6b

Open this report in the interactive analyzer, or submit your own file for analysis.