Malicious PDF — malware analysis report

Static analysis result for SHA-256 99312ba495916d9d…

MALICIOUS

PDF

80.6 KB Created: 2020-12-02 11:00:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 2523ac3b46e43d9496dcd5b7bbcec054 SHA-1: 3bfaf86fe70df98680b5d124d2197bcc39e00b5e SHA-256: 99312ba495916d9d6ccc3e643f24670d42d8708be07c87799548f96ffd3036c9
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing indicating a malicious redirector link to 'https://traffmen.ru/123?utm_term=shadowrun+equipment+list'. This URL is the primary indicator of malicious intent, suggesting the document is designed to lure users to a compromised or malicious site. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/123?utm_term=shadowrun+equipment+list In PDF document text
    • https://cdn-cms.f-static.net/uploads/4486220/normal_5fac197605556.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373788/normal_5f91c097823ad.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411917/normal_5fa1bdc87c757.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377663/normal_5fb68fd825537.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456676/normal_5fb3d13132944.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468267/normal_5fa9e746688fb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/e8474dbf-6b56-4d35-87fb-1dc049fcbaf0/19327889360.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/72090f42-7c04-4785-9002-7a4c87059878/96158668413.pdfIn PDF document text
    • https://s3.amazonaws.com/rotowan/suporamedozujapipak.pdfIn PDF document text
    • https://s3.amazonaws.com/debamijizozexo/vascular_malformation_liver_radiology.pdfIn PDF document text
    • https://s3.amazonaws.com/jifesu/male_high_elf_names_dnd.pdfIn PDF document text
    • https://s3.amazonaws.com/xelimewat/nidebuboleroliweset.pdfIn PDF document text
    • https://s3.amazonaws.com/sitozi/lorraine_lea_linen_jersey_sheets.pdfIn PDF document text
    • https://s3.amazonaws.com/datarofapakil/tevisatodamimawemunoxexu.pdfIn PDF document text
    • https://s3.amazonaws.com/liwafo/area_of_a_trapezoid_worksheet_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/nalifij/rejiduso.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cbfa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCBFA 5400 bytes
SHA-256: 35cccc807ec6be34660cf20f590e6552d718f55db25fa7c22a3cde5303b874c8
font_01_sfnt_off0000de2d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE2D 16316 bytes
SHA-256: b912dd64dd9ae28ea75db79500b1d2838aa739ed9063b13fba55b95414a6a4a5
font_02_sfnt_off00011052.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11052 16144 bytes
SHA-256: 18f56b7fae04e07bc119a468ad323bdda099da77b0772854d1c47cc1f39b9f3b
font_03_sfnt_off00012552.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12552 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.