PDF static analysis report

Static analysis result for SHA-256 98d45d5d3a03e94b…

SUSPICIOUS

PDF

85.8 KB Created: 2021-01-21 02:50:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: f7127b37bc0935c972e5e3cc5578a881 SHA-1: 21deab69a73a4a23713b6a2286cee8bab34dee9c SHA-256: 98d45d5d3a03e94b115e940c34426131c5a2aa936405a46335648f311c7a62b1
36 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that points to a suspicious domain, likely intended to trick the user into visiting a malicious site. The ML classifier strongly flagged this PDF as malicious, indicating a high probability of malicious intent. No scripts were extracted, but the presence of the URL and the ML detection are sufficient indicators.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/123?utm_term=hard+candy+makeup+dollar+tree PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4424328/normal_5fc7516f9de49.pdfIn PDF document text
    • https://cdn.sqhk.co/rosivapixove/hdBha7I/dwight_howard_celebrity_net_worth.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366010/normal_5f93bcd21ac87.pdfIn PDF document text
    • https://cdn.sqhk.co/pegipoveridi/he5WP60/52891804479.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465685/normal_5fda983425938.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366008/normal_5fc5e7adec0c5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421937/normal_5fa4a5f086eec.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370737/normal_5fac44c77c13c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375076/normal_5fc2cdb0d6fb3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454973/normal_5fa75677186ac.pdfIn PDF document text
    • https://cdn.sqhk.co/jogekiluse/qidpijq/disojul.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366630/normal_5fc86638c5595.pdfIn PDF document text
    • https://cdn.sqhk.co/molofagaji/ciWxia9/big_win_jelly_apk_mod.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/roware/64214221286.pdfIn PDF document text
    • https://s3.amazonaws.com/tinajabizoreguf/wipivisu.pdfIn PDF document text
    • https://s3.amazonaws.com/pomaxa/wilod.pdfIn PDF document text
    • https://s3.amazonaws.com/luropi/kumon_workbook_free.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef7f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF7F 5168 bytes
SHA-256: eb3cbd47a7d940301538886a19d48c1c580dcd318cc867e1076810ee941a8a83
font_01_sfnt_off00010100.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10100 2736 bytes
SHA-256: fffb95ff6a9622bdd910393d211a01025de062853670b088dab4fd783d5b8167
font_02_sfnt_off00010c1c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10C1C 10896 bytes
SHA-256: 9146ced218726322503c69b3369b5afd40966bc4568e637ea0e2e24979de69a5
font_03_sfnt_off0001311d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1311D 17292 bytes
SHA-256: 4573491982ce1d87061dd7bd920e632b9abc5899fec8313cedd6c77c664ad7f7

Open this report in the interactive analyzer, or submit your own file for analysis.