Malicious PDF — malware analysis report

Static analysis result for SHA-256 884c27dd4a6dc4e2…

MALICIOUS

PDF

63.4 KB Created: 2020-11-16 15:34:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 6ead52d4307a6bbb27fce83ae0ff7524 SHA-1: dcb5adf164a0fe3b9f477edd1ca2100acd9edaa3 SHA-256: 884c27dd4a6dc4e2afdb1b5c14fdba1e3b6e2fccefe54f83d38986fa96611d70
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=pretty+little+girl PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4368225/normal_5f8b50c65fbfe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415291/normal_5f9fa27d3b2e2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/memul/mann_buddenbrooks.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d6259aca-28a3-405b-a52d-2b69b6342ada/14415231333.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e16ba2a3-2237-4b9b-af99-1acc253c6f6c/fenaxafagur.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b645d4e7-90ea-4598-8720-31762c1eb867/degoputufotogenasax.pdfIn PDF document text
    • https://s3.amazonaws.com/tesapibebujep/8821401681.pdfIn PDF document text
    • https://s3.amazonaws.com/fokapikow/93141622998.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf8f99c9-6c69-41c9-9394-63dd5b88db39/dennis_kimbro_think_and_grow_rich.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/329613a6-0e35-41d4-ad09-f764d3e86fb0/jump_n_carry_jnc660_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bf41.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBF41 4568 bytes
SHA-256: acefa9a1601cd6017400924e617dd40f7eb790727bdbec01fc366709194428dc
font_01_sfnt_off0000cee5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCEE5 9984 bytes
SHA-256: 9b45b50e89b5c7bccc982f07d5d785c1bb7153a78cfbd912e81537bf7a796f2f

Open this report in the interactive analyzer, or submit your own file for analysis.