Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9696b7c2a274365…

MALICIOUS

PDF

70.5 KB Created: 2020-12-23 06:42:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 1d5095f7e3d84544c89061572e31f106 SHA-1: 6de94b7c631a6f783496d0327c22bb443757834c SHA-256: c9696b7c2a2743656ba80ac5de6f77f22bb11561f2a5f878e8a96b8e11836d21
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a machine learning classifier and ClamAV, as malicious and phishing-related. It contains an embedded URL that directs users to a suspicious domain, likely for a phishing or malware distribution attempt. The document body, though heavily obfuscated, suggests a lure related to 'carnivorous plants'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/strik?utm_term=nom+des+plantes+carnivores PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4422894/normal_5fad68adddba3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449775/normal_5fdb9c67177ed.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4474727/normal_5fb2925be2c80.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403807/normal_5fbdcf0b3dad3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446761/normal_5fbd4be10c3ed.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static1.squarespace.com/static/5fc38c0cea4a794d5655cf02/t/5fd045c1ef76c20f2d4391e6/1607484866107/54182537752.pdfIn PDF document text
    • https://s3.amazonaws.com/xapidajovaji/kevamup.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fded181546cca2c41591fb2/t/5fdf264d15a11837d0b4aa9b/1608459857185/green_background_images.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0cbc7c6d964583621a279/t/5fc3f6fbeaf37e3b6416f6eb/1606678268453/54380174762.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6d632c39fde0238a5f002/t/5fcdaaa7662d5e24e0bfa266/1607314087455/xapozosizefosotimev.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0b4e4c89e1c4b8fbd626a/t/5fc3b81a08845d0924fb5370/1606662171384/ethos_logos_pathos_aristotle.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc36877e9fc3622d5320d5c/t/5fc53f473570fb44d1ae5d99/1606762311730/spotify_apk_2018_ios.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fdd37863f59a2572d8ffde5/t/5fdd3e59892c8943b091d8bc/1608334938417/xajabud.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c83f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC83F 5036 bytes
SHA-256: 16e43cff5364b6c5245c9c34be7f2da22f03b47bd9cb8f72b8164fcdb01b587a
font_01_sfnt_off0000d948.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD948 11708 bytes
SHA-256: be3002b7d3f31e7e297c40bb31efab6445ddb566c23c3c7026ab5af2d5d04908
font_02_sfnt_off0000fdb6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDB6 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.