Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a4f04318fde2b38…

MALICIOUS

PDF

66.8 KB Created: 2020-12-14 01:55:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02
MD5: 2c9931d04b6f42316e8263adb10c9f05 SHA-1: 9ba211e8d5397b8b482270d407939255f6e9411c SHA-256: 9a4f04318fde2b38561b9d0556ca20ac5af09d89586d99ca4c936e564ee65820
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/aws?utm_term=extra+bass+telugu+dj+songs In PDF document text
    • https://cdn-cms.f-static.net/uploads/4418188/normal_5fc1c52b0c075.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd1b6e4397200107e34052/1606228846905/plants_of_the_gods.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ea10177-bbd4-4c42-ac6c-257eb4e102b6/wps_writer_download.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5820ae9fc3622d5411e5f/t/5fd006be6742965a9df03cf5/1607468735367/kezotax.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1965e5e8e827d4292b594/t/5fc78c86c953717e09dc6afa/1606913166479/2529895036.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fce2dc706af1e3f448c2ec4/t/5fd69ad5491a58544a1a80e2/1607899862470/achievement_motivation.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2f28524b06a7eb30cb0f7/t/5fc8fe6d3435706273ba9c29/1607007853404/colour_picker_tool_windows.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd1a827dd1bd0a7626427e/1606228611433/40473357145.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42d55aa6-d429-48de-8438-b1a145e7d510/73057686909.pdfIn PDF document text
    • https://s3.amazonaws.com/dazovosugev/badaxomijiwifu.pdfIn PDF document text
    • https://s3.amazonaws.com/nuruvapozixix/sslc_2019_marksheet.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc28bf30a2757459bed6a63/t/5fd03f7775f5e504856bb619/1607483256344/ximevagepokegiguxidivu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bdab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBDAB 5232 bytes
SHA-256: 1428c80c449e5af5abbc8db6a25ac22d206ee1794e1eca7cacae0f6e646f6fa2
font_01_sfnt_off0000cf82.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCF82 2184 bytes
SHA-256: 0cc147490d02ef851cc39064e7511569bf7d508d07e15b507379f37c3405d272
font_02_sfnt_off0000d986.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD986 10844 bytes
SHA-256: 1c58728e8a633b433ec8988c885bb8f60d12686693701fce862e5cfb7e99a0c8

Open this report in the interactive analyzer, or submit your own file for analysis.