Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f83163f7cc012c4…

MALICIOUS

PDF

67.5 KB Created: 2020-11-25 21:54:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 08c276539fe5c398ddf4846576975b67 SHA-1: 2bc451d6a1614b515448a06a1d760d1d52b7fb5d SHA-256: 9f83163f7cc012c4dc85ab12d5454057ce9aaceeae318b5e9eb5c902ea4de94b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/strik?utm_term=translations+of+functions+worksheet+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4404953/normal_5f9c826277c60.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375708/normal_5f8f9b481ed8f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404293/normal_5f93d76d2c725.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4467915/normal_5fa99593a8595.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375514/normal_5f9a8327c1c58.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sepawi/diabetes_guidelines_in_spanish.pdfIn PDF document text
    • https://s3.amazonaws.com/bizamesuwepe/autonomy_defined_psychology.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9de2deb1-7dfe-4035-9f83-7bcf71c5d022/71085262624.pdfIn PDF document text
    • https://s3.amazonaws.com/daselex/ps_207_early_childhood_center.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4ee0774f-3280-4548-b29a-43456f7976ce/vebedoxofeguli.pdfIn PDF document text
    • https://s3.amazonaws.com/didowugorokirug/tudexojiliz.pdfIn PDF document text
    • https://s3.amazonaws.com/forupokisip/64232112374.pdfIn PDF document text
    • https://s3.amazonaws.com/jexijer/10246910572.pdfIn PDF document text
    • https://s3.amazonaws.com/sojebelevenex/general_formula_for_nth_term_calculator.pdfIn PDF document text
    • https://s3.amazonaws.com/tuzakifezara/cutting_tools_types.pdfIn PDF document text
    • https://s3.amazonaws.com/vazisi/69927962351.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000be29.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBE29 2872 bytes
SHA-256: b8f35b12204abea0e1cb671202dcb4ac6a576be080e4c1ac43c9cfdb8c10db6d
font_01_sfnt_off0000ca89.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCA89 5348 bytes
SHA-256: 146bcb1c253016a509abc231ab6fadd58b780b5f4328e7989bd7d1ba2156ea38
font_02_sfnt_off0000dcc5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDCC5 10492 bytes
SHA-256: c13961e24fbaff3861df8607d2a000181417f56ec43f6819c9a6216923d56e48

Open this report in the interactive analyzer, or submit your own file for analysis.