Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf3414bb5d49e510…

MALICIOUS

PDF

109.1 KB Created: 2020-12-01 18:08:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02
MD5: 4b7165a211e6b627961cc8bf6ee329eb SHA-1: 7620fb447f0ec8e734a868c816cce8fbf60f6135 SHA-256: bf3414bb5d49e510ab71fc5a8e707b0f88ca90f80537cd91e37a37c1f32bec83
214 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses brand-impersonation credential phishing. The file routes users through malicious redirector infrastructure. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://maladebo.weebly.com/uploads/1/3/4/3/134305387/bogurefetur.pdf.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/123?utm_term=what+does+designated+for+assignment+mean+yahoo+answers In PDF document text
    • https://static.s123-cdn-static.com/uploads/4367632/normal_5fc5aed50c9d4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378613/normal_5f9068fc6b77b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403428/normal_5fbf353e691c5.pdfIn PDF document text
    • https://maladebo.weebly.com/uploads/1/3/4/3/134305387/bogurefetur.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477167/normal_5fc1ee733c5f1.pdfIn PDF document text
    • https://fiwugoxatalaj.weebly.com/uploads/1/3/4/4/134498599/dd018d2bc7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd1911ead99d6e747c4517/1606228244362/6763454.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc2b8abe-1d18-4609-91d1-cf6fe84009a7/botiremuwi.pdfIn PDF document text
    • https://s3.amazonaws.com/wixamupelinere/pelokulixukatal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80a573ac-728a-40dd-a6fb-a25fa3a2d643/dj_pro_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb296047-a8b0-45fa-aeec-f49003989909/77980765440.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0d8879c08c7f2ba108b4/1606225301949/the_undermine_journal_addon.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00016b2a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16B2A 5496 bytes
SHA-256: 305b51657becead0545c6b9d7f5e6223039bc5fa686d567fe8a941a7e6a9f275
font_01_sfnt_off00017dd0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17DD0 12364 bytes
SHA-256: d497646bbe7b118b5c9b79d068b5fe843b3787d53dcbad79bb4782e1f4e3a683

Open this report in the interactive analyzer, or submit your own file for analysis.