Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f9c5172d35e0758…

MALICIOUS

PDF

70.4 KB Created: 2020-12-05 17:07:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: b657d95f890972519e65ae55d72fc4f3 SHA-1: 8378a07d7a3c3a6204ce56f27df99099edf5d0cb SHA-256: 6f9c5172d35e0758c7d1253506d94782ab1c9924f176f5fefe712b9adbec44f2
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/123?utm_term=how+to+leave+a+clan+destiny+2+pc PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4427080/normal_5fa6e181ef3c5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd13daead99d6e747b529b/1606226908648/similarities_between_balance_sheet_and_income_statement.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc585d3c6229360eccc3db1/t/5fc9260ccea2f051aa7a3864/1607017997116/city_racing_3d_games_free_download.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0f06b104edf1d7780fa74/t/5fc43c323c6ccf69f3e546f7/1606695987370/ford_transit_interior_lights_wont_turn_on.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f5e9e401-c833-4aec-82a7-bf75313449d5/xevuxovaligakufiguwek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a75a6ce8-a655-4905-949a-5747cb405aea/garugubuvosulediki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8bc7a64-ab1c-48e4-a692-ba71b9860198/pimemituw.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f3b10cc-da2a-4037-8e4d-bab03868d070/zinarirezoxokun.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0cc6dc14dfd36fef0f123/t/5fc0d6b03570fb44d122aa1a/1606473392654/mazda_3_forum_hr.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2226e72f-3db5-4ea0-8523-599588cfaf47/banshee_prime_quake_build.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c796ca25-32a9-4dbd-814d-a999b75b4a9c/dolphin_premier_robotic_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000be51.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBE51 3312 bytes
SHA-256: 0ed8070f68161b95ebeaf287ff6bd57d8aa9402ee743a3f3f8ab59372d4a1643
font_01_sfnt_off0000ca40.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCA40 5108 bytes
SHA-256: 10549d5c27004b8b8897e178fed5e010b577ab9ee89ff5009eaba23207024aaa
font_02_sfnt_off0000dbc6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDBC6 10448 bytes
SHA-256: 97cc2b6e49cf8e135ac5926d199aa6974bfdda8782e69dfb6a0ab9b897b96716
font_03_sfnt_off0000fddd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDDD 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.