Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa25f38dfc487e7d…

MALICIOUS

PDF

370.0 KB Created: 2021-01-13 22:35:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 769bc79154c51cb56affe7760549d179 SHA-1: d369649a7c37d6a2fd0af6f04857747c347e8ddb SHA-256: aa25f38dfc487e7d743e9ddce198cbff081206104b6d5d9c31cd7006349602a7
116 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The sample is a PDF document flagged by multiple heuristics and a machine learning classifier as malicious, specifically identified as a phishing or trojan variant. The 'SE_CALLBACK_LURE' heuristic indicates the document is designed to trick users into calling a phone number, a common tactic in tech support scams or callback phishing. While no scripts were extracted, the PDF structure and embedded URLs suggest an attempt to exploit vulnerabilities or lead the user to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9570

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=digimon+field+guide PDF link annotation
    • https://site-1202636.mozfiles.com/files/1202636/90221468087.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426421/normal_5fa0dbd948b23.pdfIn PDF document text
    • https://cdn.sqhk.co/jiluputumusi/jc24Fgd/chickens_that_lay_colored_eggs.pdfIn PDF document text
    • https://site-1196306.mozfiles.com/files/1196306/pufawimekuwanizideregar.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490125/normal_5fc56eba1b88e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487431/normal_5fc428f03d16c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4473890/normal_5fa7fd9cebf96.pdfIn PDF document text
    • https://cdn.sqhk.co/muligumixe/fhaxbJ4/bovinupev.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413017/normal_5ff1efd33855c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454042/normal_5fe39db59fa1e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4443357/normal_5fdeb2020af83.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486356/normal_5fc2413f3da22.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4422371/normal_5fe4ac424fb6e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://s3.amazonaws.com/xiwevitox/web_designs_templates_free.pdfIn PDF document text
    • https://s3.amazonaws.com/fewifuwu/how_to_add_gridlines_in_excel_spreadsheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off000507e7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x507E7 34000 bytes
SHA-256: a12db7cc86cdff3ec1a99c5545d3301bb3ca561be66c33db677452d7b6e2f73a
font_01_sfnt_off00056fcf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x56FCF 4740 bytes
SHA-256: b47c68591352a0989c1822c5021470d9deb40b3f3cb41ec23e6107d7ce3a3b31
font_02_sfnt_off00057fe8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x57FE8 2832 bytes
SHA-256: a737a833e42c11eaa64a5e36f3724a9c5b40dfb89583463d51a1bd6cb2a786fb
font_03_sfnt_off00058b0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x58B0E 13680 bytes
SHA-256: 2b8b65c75d0603e58605173a105ce2a2492d433efa46f04a74b8fadeb899a579

Open this report in the interactive analyzer, or submit your own file for analysis.