PDF static analysis report

Static analysis result for SHA-256 97e41e59c73715ba…

SUSPICIOUS

PDF

71.4 KB Created: 2020-11-13 16:21:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 117a07ff2e656f708f2e807a7be4f855 SHA-1: 19950fbe0d9c05437ce2e272d41f5594b3dbd1d6 SHA-256: 97e41e59c73715bac72765317c4e9b211783ca7c9356c1ab9795fab2ea14424d
36 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that is flagged as suspicious. The ML classifier also strongly indicates maliciousness. The document body and metadata contain references to 'Arteria iliaca interna pdf' and 'wkhtmltopdf', suggesting a potential lure for information related to medical terms, possibly to disguise the malicious intent of directing users to the suspicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=arteria+iliaca+interna+pdf PDF link annotation
    • https://lodovanu.weebly.com/uploads/1/3/4/4/134403978/rinifisu.pdfIn PDF document text
    • https://bafovulik.weebly.com/uploads/1/3/1/0/131070506/04a0a722529b.pdfIn PDF document text
    • https://bubixoduxufito.weebly.com/uploads/1/3/1/0/131070588/vasan.pdfIn PDF document text
    • https://xavoxoxuda.weebly.com/uploads/1/3/1/3/131379246/kolelonetilekoxa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed9f8e0f-c0ac-401b-be99-1399e68095bb/rusudazimepagumilip.pdfIn PDF document text
    • https://s3.amazonaws.com/lumixi/toteziradajifixep.pdfIn PDF document text
    • https://s3.amazonaws.com/jinabom/fallout_4_human_error_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/ganubatebedoxez/mazomirazozepexi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d37b1538-35c8-4b0b-8231-727c8f2c6946/gilumimib.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fefa69ea-fc0c-42c7-bb9d-4637fafae1db/xitovi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dad4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAD4 4960 bytes
SHA-256: 0e758e0a07d38899f0873c950db44ede8be5a91409fc29922cc07212d2c93345
font_01_sfnt_off0000ebc5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBC5 11304 bytes
SHA-256: d9c58ecd511d197fbad3c7cdd3aa5ae99c563b32ec2e3acd55d3ded38c681cdf

Open this report in the interactive analyzer, or submit your own file for analysis.