Malicious PDF — malware analysis report

Static analysis result for SHA-256 96a3f4b43b273ba1…

MALICIOUS

PDF

75.6 KB Created: 2020-11-13 09:11:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 9918df42f22625f87912c16d667b8529 SHA-1: 8d735651d3eee0a5e792b574c2b721f5060c6d0b SHA-256: 96a3f4b43b273ba1a8442945e2ad7880561eab65c9afce92746c87eb7d30ea4a
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain, identified by both heuristics and a machine learning classifier as malicious. ClamAV also detected it as a phishing trojan. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDFs from web content, further supporting the idea that it's a lure. The presence of an external URI and the ML/ClamAV detections strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/aws?utm_term=transform+assertive+sentences+into+interrogative+sentences PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4407733/normal_5f9524e2411fb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4389127/normal_5f9be67b039c2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367667/normal_5f8ba8ab1c32b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383571/normal_5f9a8037dfc96.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411503/normal_5fa756ac42d9b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407100/normal_5f9353589c503.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420448/normal_5fa214f1e7713.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374685/normal_5f95668c6cf32.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406782/normal_5f94130cc06d2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387040/normal_5fa5fda34f08c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/negonanopix/xugozudupokovovep.pdfIn PDF document text
    • https://s3.amazonaws.com/zetare/47139981921.pdfIn PDF document text
    • https://s3.amazonaws.com/nitirew/96236354125.pdfIn PDF document text
    • https://s3.amazonaws.com/kibavutibeved/77125062745.pdfIn PDF document text
    • https://s3.amazonaws.com/nilititonawafim/unblocked_games_66_king_of_fighters.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c815.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC815 5180 bytes
SHA-256: bfad012bb5207f33b11ae1daeaaae586b1b54dff960f536be18c6b0128b2319a
font_01_sfnt_off0000d9a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD9A1 10392 bytes
SHA-256: 1f9ce4e8a97d7806bc26ff91761ab0de7bd1a3d858111048673b57eb0bcb4a3f
font_02_sfnt_off0000f9d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9D9 10608 bytes
SHA-256: 8aa9d78266e310fff683aa32587691a63faa0fe21f02f538695f5402926f94e6

Open this report in the interactive analyzer, or submit your own file for analysis.