Malicious PDF — malware analysis report

Static analysis result for SHA-256 765467676350f438…

MALICIOUS

PDF

71.6 KB Created: 2020-12-17 17:52:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 65cdb2ebea65c7b8d008390575633683 SHA-1: c1779eb66f318178347acf7bfeeb610eb0734e25 SHA-256: 765467676350f43855b0e9c1b8d8bc53fd9f675e9c0bc5d7f04f69fbefb14138
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by a ClamAV detection and an ML classifier. It contains an embedded URL pointing to 'traffnew.ru', which is suspicious and likely used for phishing or to download further malicious content. The PDF structure and embedded artifacts suggest it's designed to exploit vulnerabilities or trick the user into visiting the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?utm_term=bridgestone+ecopia+ep422+plus+review+snow PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4368471/normal_5f8c8c0d8b816.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368251/normal_5f87e2c076931.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417023/normal_5fd22cddc5e83.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410952/normal_5fb2e1395b05b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417220/normal_5fa97efe91a9a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391008/normal_5f9d74b3e6af8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a93d274f-fcdf-412a-97a4-3a144fd50354/kaspersky_reset_trial_5.1.0.41.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5936eaffbf90a660a4a03/t/5fc8f43118eb434f9ec79e5a/1607005234261/37159046684.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc7884da-5ba2-4b74-a897-9a746549bf16/niluposugudumajob.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d955.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD955 5664 bytes
SHA-256: fe3397e9cbde595ef1d35a4da459a08362281b5acf1a4ce8931f6c90b67409e3
font_01_sfnt_off0000ecd1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECD1 10876 bytes
SHA-256: a125f137a7352f2e7af81e90d98586117773118158f86f15e289959c7b53afc9

Open this report in the interactive analyzer, or submit your own file for analysis.