Malicious PDF — malware analysis report

Static analysis result for SHA-256 6dcec1560cd85720…

MALICIOUS

PDF

100.5 KB Created: 2020-11-11 17:43:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: eab07b9c4a480c1bf64e76385fee397c SHA-1: d7be84179fe0fc7f65f79fa236924c628eebd3a1 SHA-256: 6dcec1560cd85720e6848302f05a9d88feba644b9726dabd0d58182177490c13
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=complete+no+intro+rom+sets PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4390329/normal_5f9a172f996a3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369313/normal_5f8abf907f093.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370543/normal_5f98a232cc02f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383571/normal_5f8f5068d742d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373271/normal_5f9b2ebe4de12.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408009/normal_5f920a6856433.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375891/normal_5f8c02000266b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367007/normal_5f87ef1e5fe36.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445333/normal_5f9fdb8d9fbbd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4419198/normal_5f9f2dae28084.pdfIn PDF document text
    • http://sigkillit.com/wp-content/uploads/2020/10/Clean-In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f2ca279-9738-4fcf-af4c-058c7ee55d00/83306515512.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d91e1723-2e48-4832-b7c4-172832f64a32/94861034276.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bdc34e62-f791-432d-a651-f173e13d47ba/85492846809.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f71b347-538e-4424-9de0-8ea57902a0d6/74570623828.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/548bcc40-8897-4f2d-9f6b-eaf083c186f0/wenowofadapizak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad0abd52-f712-411d-80ca-b11a55bcd781/xigilerotaxevifivozatofe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00014892.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14892 4660 bytes
SHA-256: ef22c32dee72b55bdda129844cdf12e815a3e44afe38ed209a4b95363af6b16d
font_01_sfnt_off0001584d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1584D 13380 bytes
SHA-256: 2cadd83a9fdacce67c93cb646eac1e53dcee40f45083eab48a48efa9b1c1196c

Open this report in the interactive analyzer, or submit your own file for analysis.