Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad50f50dfa7e9903…

MALICIOUS

PDF

70.5 KB Created: 2020-11-16 21:33:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 285533e3c36a2899e9ef69631a90e136 SHA-1: 5b9ee27c8dda822a6a19a077c2af17599c898529 SHA-256: ad50f50dfa7e990304214ceafc36d1d31e29626475b80af9d98470e0e53b8c6d
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file is identified as malicious by a ClamAV signature and an ML classifier, indicating a phishing or trojan payload. The presence of an embedded URI pointing to 'traffnew.ru' and a heuristic for a visual download button suggests a social engineering lure to trick the user into downloading a malicious file. The document body, though heavily obfuscated, contains references to fonts and download prompts, reinforcing the phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/strik?utm_term=constantia+italic+font+free+download PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4378160/normal_5fa4f184acaa3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468563/normal_5fae69f3f3c01.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zidosozawok/oak_grove_plantation_va.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64f89bd0-4e6d-4629-badf-7a76f2b9bfdd/tujakama.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/74681e92-8ad0-4e1a-bbdb-54df2fb8a2b5/bakiforuwaradajidizuv.pdfIn PDF document text
    • https://s3.amazonaws.com/xanebavifamopez/fagemadi.pdfIn PDF document text
    • https://s3.amazonaws.com/farezelof/85185813443.pdfIn PDF document text
    • https://s3.amazonaws.com/belapawerezuju/18070147902.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c857e2a-4e76-4e39-9c69-28ba3bf156a3/zekinabejezopafunabi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/39bf2ac3-01e5-4313-b404-ee51310b3177/binugoditisabelimipom.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3091bac-3ea6-4414-8f05-fccc9a8aa33a/poe_skill_tree.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d58c589c-0fde-4d9e-9ee4-bec10791ba56/zogaferaridizigur.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d923.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD923 5012 bytes
SHA-256: dc870b41039f043d25e455833a9632a82087342872a7defc1e81031a283f60da
font_01_sfnt_off0000ea48.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA48 10280 bytes
SHA-256: 69a4084381619b709bf783cb60ddb68c00c09c3c4ebb6aebe5c24eb7fc6b763f

Open this report in the interactive analyzer, or submit your own file for analysis.