Malicious PDF — malware analysis report

Static analysis result for SHA-256 af7ac6634fa3c131…

MALICIOUS

PDF

82.2 KB Created: 2020-11-13 12:03:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: bdae94d2375264c2f1f539795c9d6437 SHA-1: 9e0bbedf53e3fc67c8e3a2fad1d2507558ce750b SHA-256: af7ac6634fa3c131a83cfba68a725d43573666f3b847983f9be7bf8334424608
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that points to a suspicious domain, identified by heuristics as a potential phishing or malware distribution vector. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=as+path+access+list PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4370089/normal_5f989b0e44f82.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470696/normal_5fac58cd300ed.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426558/normal_5fae4f795bdb2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373517/normal_5f948b2982ebd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382958/normal_5fae1077547a3.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/jepavilutabilel/fatekulojusujutemiminul.pdfIn PDF document text
    • https://s3.amazonaws.com/susopuzupure/13566197708.pdfIn PDF document text
    • https://s3.amazonaws.com/lomogas/69768167403.pdfIn PDF document text
    • https://s3.amazonaws.com/teximikamukubo/cartel_de_los_sapos_serie_completa.pdfIn PDF document text
    • https://s3.amazonaws.com/zolerazowubow/68266025365.pdfIn PDF document text
    • https://s3.amazonaws.com/fokapikow/guest_book_banner_images.pdfIn PDF document text
    • https://s3.amazonaws.com/gagagakigibapo/haley_hotchner_actor.pdfIn PDF document text
    • https://s3.amazonaws.com/mijedusovineti/dedulifukuvutukozojo.pdfIn PDF document text
    • https://s3.amazonaws.com/xumakomowi/laughs_in_hidden_meme_generator.pdfIn PDF document text
    • https://s3.amazonaws.com/xubifupi/plus_confirmation_sheet_uci.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00010931.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x10931 21512 bytes
SHA-256: b135ee23a83f6ec87d96bed019bfbb969e85d236aacb5ba4381572e3bf544705
font_00_sfnt_off0000c914.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC914 4488 bytes
SHA-256: 8789038856dafabb71f476cf88f347c3846c38a16cd239bc0dd60f6cee203b7d
font_01_sfnt_off0000d851.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD851 15612 bytes
SHA-256: e029aca9a84d0d1c66b70f1bd7bb19d3db28fd9529f5eeed091cef8f650d793a
font_03_sfnt_off00012d71.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D71 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.