Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fdcbcc13abef378…

MALICIOUS

PDF

69.9 KB Created: 2020-12-27 23:51:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-03-01
MD5: 8c6d459978244b094c8ccc846f6eb964 SHA-1: f05feaf32406d61206e581f76ab76bc3061b3dbf SHA-256: 9fdcbcc13abef37897abbf8d483482bafe7025993c060047f3ae46d5b2ebf366
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/shook?utm_term=rainbowenglish+2+%25D0%25BA%25D0%25BB%25D0%25B0%25D1%2581%25D1%2581+%25D1%2581%25D0%25BB%25D0%25BE%25D0%25B2%25D0%25B0%25D1%2580%25D1%258C+2+%25D1%2587%25D0%25B0%25D1%2581%25D1%2582%25D1%258C+%25D0%25B0%25D1%2583%25D0%25B4%25D0%25B8%25D0%25BE+%25D1%2581%25D0%25BA%25D0%25B0%25D1%2587%25D0%25B0%25D1%2582%25D1%258C PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4452846/normal_5fcbc1dfa192f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368475/normal_5fdea1e1131d0.pdfIn PDF document text
    • https://traffset.ru/shook?utm_term=rainbowenglish+2+%25D0%25BA%25D0%25BB%25D0%25B0%25D1%2581%25D1%2581+%25D1%2581%25D0%25BB%25D0%25BE%25D0%25B2%25D0%25B0%25D1%2580%25D1%258C+2+%25D1%2587%25D0%25B0%25D1%2581%25D1%2582%25D1%258C+%25D0%25B0%25D1%2583%25D0%25B4%25D0%25B8%25D0%25BE+%25D1%2581%25D0%25BA%2PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/58fd0d03-b93e-4de5-9928-16360e066bef/wiwofas.pdfIn PDF document text
    • https://s3.amazonaws.com/fizup/civil_engineering_words_and_meanings.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e1e494fc-5fe6-44f1-819e-7bc8a4ab4fec/butalonegivufidumujugi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0a4ca12-e229-47ae-b113-0d0e2100df89/lasevajeg.pdfIn PDF document text
    • https://s3.amazonaws.com/kezemiradigu/death_on_the_nile_book_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dfad1ed9-227d-461a-94fe-6632cb56b19c/chain_armor_minecraft.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47c09beb-89e4-47ff-bb63-f498cd0382d7/jejonax.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70f38e49-50e2-4692-b985-4b7d6dfa6b13/giwatam.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c115c8ba-3789-417e-8a53-f2b05bd4e0db/los_callejones_los_angeles_ca_map.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/601139b4-4a3a-46be-8d64-b60e6eb5694a/juziwuberusenixapinulo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4017bd1a-2646-4273-a366-c3f796d9f2e9/1586207101.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fe27e2f0-6da5-42eb-9bc3-559a20c04db3/dorojiseweg.pdfIn PDF document text
    • https://s3.amazonaws.com/vabedafozo/84741587441.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c2c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC2C4 6596 bytes
SHA-256: 1157fd6196b3f0995f0a8e68143db44c082f0313e5d42dee28a02829cda3f014
font_01_sfnt_off0000d888.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD888 14976 bytes
SHA-256: fb7ae923384b7a736c227eea775a3390d5be0c75b56cd055bf7326da1f743e1c

Open this report in the interactive analyzer, or submit your own file for analysis.