Malicious PDF — malware analysis report

Static analysis result for SHA-256 9950f314a5eb195e…

MALICIOUS

PDF

76.9 KB Created: 2020-12-21 03:35:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 1a6ef6a5551c559488bb38a806145079 SHA-1: 74edd1dedfb46f01edf1377584c32869f3b8e4d0 SHA-256: 9950f314a5eb195e6512cc2247cbb8845a102abc4dc112acae161f4be32ab63f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL, disguised as a search result for 'love anniversary images hd', likely leads to a phishing or malware distribution site. No scripts were extracted, but the PDF structure itself is indicative of a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=love+anniversary+images+hd PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4368467/normal_5f918e44c8aed.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369665/normal_5f8bda3116c2e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366399/normal_5f8762fad45ed.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379355/normal_5f8f04d05e4f9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453551/normal_5fc70761aa30f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4463263/normal_5fa312982a9e4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4463272/normal_5fdfd80f225b6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385422/normal_5fcb794e6e74b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379742/normal_5f8d00b700ccb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387924/normal_5f9578671e3bf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367624/normal_5f885d8cc0a96.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://uploads.strikinglycdn.com/files/69cf67cb-10ef-4d60-a921-ef38869f23f4/22631918534.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa3839fc-f412-4831-9fb9-900354a0cd5f/rerobezokugipitumun.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90d612e0-5418-4075-b388-5a5c2b837995/36726335190.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d6ac862d-d722-455a-9fd0-8d5e0bd8035c/dukidebesexelafutidosi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1cbb3f6a-a4a6-44cd-9172-13868c7200ea/reflected_appraisal_definition.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bff9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBFF9 5308 bytes
SHA-256: 8aac533be2a0747e0845e421d334ff3492539e6a03b28495fe8d99f37e1f5907
font_01_sfnt_off0000d1ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD1EC 10264 bytes
SHA-256: 2e2e9ba445b75ed0f7ceb260407666dd94de654288b9314f108f237ec379c619
font_02_sfnt_off0000f514.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF514 16104 bytes
SHA-256: 45a9d45584ce6025e1225e28cc38a502a022d5defc6af287acd8796dd2ea1153
font_03_sfnt_off00010a27.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10A27 7820 bytes
SHA-256: 61ef3c9439fd841216b96f62c46cb7e327954e77c6f29187552d634fdbed2a10

Open this report in the interactive analyzer, or submit your own file for analysis.