PDF static analysis report

Static analysis result for SHA-256 614ee92db2becf12…

SUSPICIOUS

PDF

78.4 KB Created: 2020-12-05 20:48:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: f3ac9508b1dfbb9da2899474e43649ba SHA-1: 910b17c8070fddfab7f982b2705f7c11f3b7f9d2 SHA-256: 614ee92db2becf12b171d16a5cf421137ab7574bf57d58d45b4135bb8679a270
36 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as suspicious by an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=etapes+de+formation+de+l%2527himalaya PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4450340/normal_5fbdbc9f9612d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4449769/normal_5fc7fff01d678.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static1.squarespace.com/static/5fc1015360f2895dc1e86a3c/t/5fc1952aeaf37e3b64d82797/1606522156727/68735698843.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4dfad403f5353fdaf152a/t/5fcacd3f85bc3a28a6fc89c5/1607126336740/roblox_download_unblocked_chromebook.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3aaa6bd7-f407-4220-aedc-7e9d089a8ffe/lolodorawo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6e6aa54d69c5962322ebc/t/5fcb407085bc3a28a607b9a6/1607155837663/10576825198.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc56133a3bf4b14abc7046c/t/5fca08a8196a600d3c37865a/1607076009403/elite_killer_swat.pdfIn PDF document text
    • https://s3.amazonaws.com/fodose/award_certificate_template_google_docs.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc363b5c6d964583631f5aa/t/5fc516391972c46e3c3f170e/1606751802306/16752589797.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc115d62bbd7406580792b0/t/5fc45d911972c46e3c29283c/1606704530161/self-care_behavior_inventory.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cf07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCF07 5160 bytes
SHA-256: 1f30236fce3c492998b184e6a0df43e5957fc23ecfdd998518358c3c198040c0
font_01_sfnt_off0000e070.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE070 12588 bytes
SHA-256: 80f8caa59e30c379a0c04576b50d124063e6a3453a6334ba9f2327eafeafcce5
font_02_sfnt_off00010801.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10801 16084 bytes
SHA-256: 096dc22bd3c9caec6309818842dfa19dd0da92d8ef7919229ff7edf1d3f8df14
font_03_sfnt_off00011cb7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11CB7 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.