Malicious PDF — malware analysis report

Static analysis result for SHA-256 9964a814b379e4cd…

MALICIOUS

PDF

61.2 KB
MD5: 4bcd422bbc3db021a18e1298bf1577d7 SHA-1: 53d0c164a5c814827a309b0123ee2a0a3e597f5c SHA-256: 9964a814b379e4cdbf3769d940e00162e7310ec8bd7a4072474c47d6634811f4
114 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF document utilizes an image-only lure, presenting a screenshot of a PDF viewer to trick users into clicking a link. This link, identified as a direct payload, leads to a RAR archive hosted at 'https://adoba-us.online/pdf-viewer-online.rar'. The ML classifier also flagged this PDF as malicious with a high probability. No scripts were extracted, but the direct link to a payload is a strong indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8788

Heuristics 4

  • PDF link points directly to executable/archive payload critical PDF_DIRECT_PAYLOAD_LINK
    PDF contains a clickable HTTP(S) URI whose path ends in an executable, script, shortcut, disk image, or archive extension. Documents can legitimately link to installers, so this is a high-risk delivery indicator rather than a standalone exploit fingerprint.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 2 text block(s), carries a click-outward action, and is only 61 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://adoba-us.online/pdf-viewer-online.rar
    • https://cdn.discordapp.com/attachments/847360629584560142/894503193483018240/Swift_copy.cab
    • https://cdn.discordapp.com/attachments/894851708889477193/897019728747458601/Swift_copy.cab
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://ns.adobe.com/tiff/1.0/
    • http://ns.adobe.com/xap/1.0/
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdfx/1.3/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_023_off0000dfd6.js
140faf01021bf596aa28648de25e68f1445fb9ca811027329d16b9a784b5dd55		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xDFD6 239 bytes
stream_026_off0000f27c.js
194989e1efc0f26876ffa9ed15bad44aadcd46722299aedf51480c141a6c4a7b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF27C 239 bytes
font_00_cff_off00001c2f.bin
5c9ad89521f47e0e07e664fedc6615d77049fb80dd2bc2ac56b7ba7d44fe3ae6		 pdf-font-stream PDF embedded font (cff) at offset 0x1C2F 2406 bytes
font_01_cff_off000026e3.bin
14da413cb0be5ebe6ae0461f1fea41564dd8dcbbb8371b049b1d89e8b7da813f		 pdf-font-stream PDF embedded font (cff) at offset 0x26E3 1242 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.