Malicious PDF — malware analysis report

Static analysis result for SHA-256 67a9a15051c384f8…

MALICIOUS

PDF

65.8 KB Created: 2020-12-19 01:52:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: c95ddc5d9d4bf458a1954bacfaec8471 SHA-1: 9fb349f8f0cbd7dc9ea2342f47c2854b7ca10e95 SHA-256: 67a9a15051c384f88e8688500f3924f5fb736bbdd5ad5328acfa90f09910c927
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The embedded URL, https://trafffi.ru/aws?utm_term=leila+netflix+web+series+free, is presented in a context that suggests a phishing or malware distribution attempt, masquerading as content related to a popular web series. No scripts were extracted, but the PDF structure itself contains the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=leila+netflix+web+series+free PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4378836/normal_5fa39ff18ee1a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384472/normal_5fb59f5c8e033.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372085/normal_5fa957f32dc1c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4428334/normal_5fac5eee546d7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/novipaliwid/dell_projector_2300mp_manual.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc149a6a3bf4b14ababd147/t/5fcdcda70ab5d62feb1396a0/1607323049161/hockey_training_equipment_diy.pdfIn PDF document text
    • https://s3.amazonaws.com/baxegezivumi/dbt_skills_training_handouts_and_worksheets_free.pdfIn PDF document text
    • https://s3.amazonaws.com/lupebesu/69598897352.pdfIn PDF document text
    • https://s3.amazonaws.com/murudute/94469663003.pdfIn PDF document text
    • https://s3.amazonaws.com/zetare/xokuleteguluzofidorel.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5c1569955c744b55ca17f/t/5fc6a8303f75b16643bfb774/1606854706486/selaveb.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2adf9abaecd33182da937/t/5fcd74716f0099009e79301a/1607300210376/mean_arterial_pulse_pressure_calculation.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1162b68612547ed5f39f0/t/5fc9845381b71b40858c3e79/1607042132749/smart_connector_ipad_air.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4e4d1ea4a794d565eb1ca/t/5fd687ecdca2215260479d03/1607895021668/34354587941.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c569.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC569 5004 bytes
SHA-256: 162bc7f0f88f5e4a5895b4bad6002490621827ce1fa52119e53bf74a34e2f277
font_01_sfnt_off0000d696.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD696 10544 bytes
SHA-256: 8ea1d90c00275efcb3573f242bdffcc3298e641d507c6650f9aad18db80cab82

Open this report in the interactive analyzer, or submit your own file for analysis.