Malicious PDF — malware analysis report

Static analysis result for SHA-256 b3c4d3ba55d1e694…

MALICIOUS

PDF

75.8 KB Created: 2020-11-19 22:56:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 240d34baaa034d011b8880d9650a1eb0 SHA-1: 10c5400edfeb6d6ee060c2dabcf0971755d8e390 SHA-256: b3c4d3ba55d1e69453d12b9a0b0a0541a3e0062a9bb41c9c00bba726d3d893f8
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses an invoice-themed lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/strik?utm_term=slim+devices%252C+inc PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4370785/normal_5f9b8b2dd6b1b.pdfIn PDF document text
    • https://zozolexiwu.weebly.com/uploads/1/3/4/3/134343356/nugevajoja.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414848/normal_5f9be984eb7f2.pdfIn PDF document text
    • https://bugekawimilu.weebly.com/uploads/1/3/4/5/134589579/8243667.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378608/normal_5fa536e42bbe9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385634/normal_5f9c43011f98b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/ee7bd607-a5ff-494e-955e-53decb8f8801/sims_4_seasons_expansion_pack_free_d.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/58c36f4c-ae61-40df-a3ec-2c4e7f421307/56036713705.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38ba7cfd-4fcf-4efa-a3a4-d6f922ccec58/45172176519.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2696be77-cf21-4bb4-9f61-588f4414ff66/43065086336.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/58a68e09-acb2-43bf-9004-a74674f8fadf/gta_sa_kurtlar_vadisi_mod.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/926334c0-42b6-44fc-b67f-7af47d012c3f/61843845554.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c30ab719-3ffe-403f-8622-8b8fbdea8dbd/65632405753.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d89a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD89A 5032 bytes
SHA-256: 576255102cf7b6acf3cbff5fab88ce794a4fa3f17f7785eedc90a09015195dc5
font_01_sfnt_off0000e9bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9BC 10396 bytes
SHA-256: 4f024b89f8afd089366c00a9d1653f92bb7d29c6795251681c067056697221f3
font_02_sfnt_off00010da0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DA0 16028 bytes
SHA-256: 8345d1cc2b6b461b856d0454e2cf67edf5851291b6d0ebf21a7da0c9813a2b7f

Open this report in the interactive analyzer, or submit your own file for analysis.