Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f646852899fdd4c…

MALICIOUS

PDF

67.7 KB Created: 2020-12-22 01:32:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: def423339881ff5187a14edfea1770ee SHA-1: bc6e4250840bcd0db0b81651f8cf4a4ac3c5b40d SHA-256: 9f646852899fdd4c1c5618cf60c0ea0a071dfdc91480f21f1bde274fe8bb310b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=myclassboard+parent+portal+app PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4419003/normal_5fdf335abc178.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490001/normal_5fbc2e4ea111f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377905/normal_5fb60a5d21d63.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f16af11-1918-4d25-85ac-ea075ca08867/kabole.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0d26c5eb-2f8f-47e5-8d23-fbc65e04d89f/93_jeep_grand_cherokee_headlights.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f365edba-7ac3-4a98-9091-59cecb8bb281/24795076882.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e5e630f-ee64-4c1e-93c7-52e4327eb598/lunojijipiwometugoredav.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0f7fbe9fc3622d5227cd2/t/5fc2f6285147b1480494e532/1606612528497/5238932593.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fdd46f08715ea0dc9cdbd2a/t/5fdd85d12629b066aba2588a/1608353234799/ad_free_uc_browser_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/536b99da-76a3-40da-a174-7a1b9a38d8bd/fagor_duo_pressure_cooker.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe28264f98375720a9e944/1606297638756/lasko_tower_fan_costco.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a8d59b2a-b8ba-4388-8cc4-920995c63815/tojowinokilit.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc51b762e537a05ef2436ee/t/5fcf17c6caa95a391e6676dc/1607407558394/background_video_recorder_for_pc_free_download.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fde88431076b30d0a95c29a/t/5fdeeb7e1c66f52f5f955bba/1608444801921/zedofufusuxawavoxogude.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf5ac44f98375720d79741/1606376132416/ti_da_dopeman_mp3_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d12d38e1-7fce-47ca-9a15-9d7ba91e98c9/1950_ford_f1_rat_rod.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fdfcf47f67c863bcd18c9eb/t/5fe02b0042c0045a33265a7e/1608526593057/waste_material_art_video.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cd41.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCD41 5312 bytes
SHA-256: 76a279e8f45b767fc21f78b9325d14b20af142b2a9ee3dc3eeeff9d704404918
font_01_sfnt_off0000df6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF6B 10132 bytes
SHA-256: c49b94efbbc9d9447412432ad61dfa145c3a7eb155daee00cef6204d6967a1d0

Open this report in the interactive analyzer, or submit your own file for analysis.