Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3092b15af1b3316…

MALICIOUS

PDF

52.3 KB Created: 2020-11-07 02:27:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: e027997f39dff080607c697e8e585026 SHA-1: db9ecb76d3f1d3463845fd58c007b623795e0058 SHA-256: c3092b15af1b331660b519e376a336619578e567a562f5abd62ef10ba85eb21f
116 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File T1059.007 JavaScript T1553.005 Subvert Trust Controls: Mark-of-the-Web Bypass

The sample is a PDF file flagged by ML classifiers as malicious. It contains heuristics indicating social engineering attempts to bypass security measures, specifically instructing the user to disable antivirus software and execute commands. The embedded URL `https://traffset.ru/123?keyword=windowsupdate_80244018+windows+7` is likely used to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • Security software disable instruction high SE_SECURITY_BYPASS
    Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?keyword=windowsupdate_80244018+windows+7 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4423452/normal_5fa10480a7e7f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414695/normal_5f95f88f090ba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404313/normal_5f9a39a08949c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4390323/normal_5f96cf20a8dbd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393637/normal_5fa5d94e83898.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379032/normal_5f8bd6524831b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379844/normal_5f8c0353992a7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416500/normal_5fa0b0f06b0e6.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/69aeb0a4-0112-4a61-bf20-78f86b974ff6/48723044508.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9b757883-9284-4ce5-908f-d03c34992d11/68027744801.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/306081fb-8c0b-40d1-a4d3-551780991f2e/philosophy_of_nursing_paper.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f2782299-2da9-4c6d-b7d0-552d0204baad/the_room_three_lsung.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d8d9b181-8cbb-4935-a990-9b3221415179/rodopimotitupeponuvij.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/838e7320-ea4c-4aa5-8d39-66c8d876acee/pedomakevida.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebe815c9-2725-4bae-9ace-8845904f8db2/20014219650.pdfIn PDF document text
    • https://s3.amazonaws.com/gofilafixu/icd_10_code_for_self_care_deficit.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000088d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x88D8 5648 bytes
SHA-256: 9aea8f43b07a0ea7ecaeea974b54760f66099736eb656a0cd34296f837188d90
font_01_sfnt_off00009c5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9C5D 11660 bytes
SHA-256: daf07bf14f33512d2e74d171e3c4a3438e3bc838b064284892af40515f5eb129

Open this report in the interactive analyzer, or submit your own file for analysis.