Malicious PDF — malware analysis report

Static analysis result for SHA-256 adf9a487cbc15d86…

MALICIOUS

PDF

130.4 KB Created: 2021-01-05 04:12:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: ace42b3839b6bd0ba1bbff1794cae11f SHA-1: 0bfd0a5815cb400b9ec8e3ce955572bce5027791 SHA-256: adf9a487cbc15d86cf40174920b6d75b274f8b3ff625ed02b08f898960c9fe2a
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=a-+v+malformation+colon In PDF document text
    • https://static.s123-cdn-static.com/uploads/4498834/normal_5fec3aaa3d250.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e26ac01c-81dc-421f-a7dd-af50a8494729/rowibetejodu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ed64d2a-7fdd-4453-9931-7ca3b1580aeb/why_is_dependability_important_in_business.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11c93d0f-daec-47d9-8e2b-471865250974/island_of_the_blue_dolphins_summary_chapter_3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/754d1da6-2981-4e29-86e6-8f280b13ad96/young_life_need_talk_illustrations.pdfIn PDF document text
    • https://s3.amazonaws.com/donake/lg_oled_55_c9_user_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7cca2221-9857-4cb9-a161-6aa685417848/peditelifidikaduwosemoz.pdfIn PDF document text
    • https://s3.amazonaws.com/tobobowu/fivigebabejomamafawikuzu.pdfIn PDF document text
    • https://s3.amazonaws.com/palevijuj/criminal_case_pacific_bay_cheat_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/271de2af-b152-4aaa-982e-0edb60c43e93/98476629458.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/400f0876-6a7f-4715-bd6c-d7c0eecb44f1/57359699669.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0001c0a3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1C0A3 32852 bytes
SHA-256: 56b0a87305387485e1ee0d59bd8c5f53d2d69fb3d52e55c9e416f2260d31c7ae
font_00_sfnt_off00018bca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18BCA 4932 bytes
SHA-256: 8c45a7d5e6a85f047631a99ca28d32c02f7fe0c4a7680fb2caf4dc2410330416
font_01_sfnt_off00019c8a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19C8A 10472 bytes
SHA-256: 68350ccbe4af6b8d11233cc36da688ba78325bf963a982caefd4a45e51c33d56

Open this report in the interactive analyzer, or submit your own file for analysis.