Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac83820d1cc6b590…

MALICIOUS

PDF

91.4 KB Created: 2020-12-13 23:22:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 2aaabfcfc8a9a2020e7f61d13f32463c SHA-1: d0acdfbd9f22fac1c7100633cf3925f07eb045de SHA-256: ac83820d1cc6b590d7148a3f687d9594c4751851e5920de554444694ef4802cc
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?utm_term=listen+beyonce+vocal+range In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/09e58f3d-71ea-4c8c-9346-998febf46be0/zodabetexuxonebutigevaw.pdfIn PDF document text
    • https://s3.amazonaws.com/wizedumi/july_2018_calendar_word.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fcf2f6a9697205d6f680613/t/5fd14e4aa3069c6c1de8e3ab/1607552586086/zoom_cloud_meetings_free_download_for_android.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2aa5268612547ed696d4d/t/5fcc05ecd336b863f0ae53ff/1607206381208/54748862425.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc36737bdb33045eed226b2/t/5fcfb6a20496d067bde0f423/1607448230099/95076115082.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc781772122570d580291d1/t/5fcc27fbd336b863f0b2d63d/1607215100965/switch_nintendo_console.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d73c73a4-6edd-45b6-8f4c-9c219b77e164/40739812314.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4d9052e537a05ef22535d/t/5fc50b95fa04221c71bf2f8c/1606749080701/zuduwetaz.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc7855e1a9b7f6479380a92/t/5fc947516dcffd2c338f8331/1607026514331/ant_warder_human_nature.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5acc353-e831-4bc1-82a2-1605e5aaaa83/57867272665.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0d49a16f6d44b07be6b5d/t/5fc1f3941972c46e3ce436d3/1606546324736/guess_that_brand_cheats.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe1564bc819f1cf4a0a016/1606292836381/hera_2k_guide.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000126f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x126F3 5208 bytes
SHA-256: 3e32a4390483d55c2509372969174eccd4e067779bb295366a0cc7feee0ec5e8
font_01_sfnt_off000138d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x138D0 11976 bytes
SHA-256: 60a1dd8ceb194e45761dd2fb96b605a19808871c7754411bc24c33b70db1600e

Open this report in the interactive analyzer, or submit your own file for analysis.