Malicious PDF — malware analysis report

Static analysis result for SHA-256 a82ad5c89dae71c0…

MALICIOUS

PDF

70.8 KB Created: 2020-12-07 12:54:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-01
MD5: 06cd9b0be3a268c79f966dc2f241ff50 SHA-1: 116716ca1d51e27ef6f7c769b018cda348e6726f SHA-256: a82ad5c89dae71c01d3c18a93f89d5fdffe77425af5094214fcc98fbde48a1b9
174 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a callback-phone (TOAD) lure. The file routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/123?utm_term=prayer+for+harvest In PDF document text
    • https://puraxexi.weebly.com/uploads/1/3/4/7/134718411/mudomoweparejid_matugaboz_beteronipuxu.pdfIn PDF document text
    • https://vawovuwowoxug.weebly.com/uploads/1/3/4/0/134040368/padaduvulugidat_mebagezowufem_zuxoxo.pdfIn PDF document text
    • https://jefevitekigo.weebly.com/uploads/1/3/4/5/134586767/mojakawomu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375204/normal_5f97056862888.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/96dee75c-c729-4c76-b1f9-24292f1a6f10/67316400452.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/160abdb3-69d4-434c-9319-77888dedef36/263266593.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/004d4345-58c5-4bca-bcaa-5067fe27bc67/15670493680.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6ccae21c-5591-4a90-a813-03f661e5e74f/wamefovekel.pdfIn PDF document text
    • https://s3.amazonaws.com/legesiliv/phoebe_brother_girlfriends_guide_to_divorce.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/09ad5f38-0722-4237-9d8e-23e763ea38b8/hearts_of_iron_4_code_resources.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81c91d15-9aaa-410a-915a-4d785b1d8146/in_the_bcg_matrix_the_dog_represents.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bec7fb27-b5df-4027-ba3c-0c4980478bf6/moluwivunidawapudoki.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d78d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD78D 4984 bytes
SHA-256: 2f0c8e94bf2669a3a9fa06ebe7923663ae482dc55221f59d51da70d6c73b10f2
font_01_sfnt_off0000e88b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE88B 11296 bytes
SHA-256: 34f09d8a4559f9b1a466d93f09119913231d9f54fc979a8a928df0b5ae457231

Open this report in the interactive analyzer, or submit your own file for analysis.