Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd799f6b6e277959…

MALICIOUS

PDF

89.9 KB Created: 2020-12-29 12:51:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: a1fbf5db53369a81dc3dd0f069db5506 SHA-1: 092531e996e11b3906f0907e2731b424b8e488be SHA-256: cd799f6b6e27795976494de0ae696eaea36971c6efb38b7ceb8ed0ca2d0547d2
116 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The file is a PDF document flagged by ClamAV as a phishing trojan. Heuristics indicate it contains a callback phishing lure, prompting the user to call a phone number in a context of billing or security issues. The embedded URL https://traffking.ru/strik?utm_term=delete+my+wikipedia+account is likely part of the phishing infrastructure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/strik?utm_term=delete+my+wikipedia+account PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4378164/normal_5fa056e8b8a47.pdfIn PDF document text
    • https://cdn.sqhk.co/pujapipiwat/FkgeZgi/tibejasazerafifuro.pdfIn PDF document text
    • https://cdn.sqhk.co/susiwozobo/jcThfKr/top_90_s_country_music_hits.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tevigotu/lupikujonil.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/296ab598-370a-44cd-a11b-b641d479af3c/46945749779.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ed8fee2-4121-4b57-956a-3de84266e003/6251690794.pdfIn PDF document text
    • https://s3.amazonaws.com/joterige/encuesta_calidad_de_vida_medellin_2016.pdfIn PDF document text
    • https://s3.amazonaws.com/kavalukato/real_life_examples_of_dividing_fractions.pdfIn PDF document text
    • https://s3.amazonaws.com/tasufagijaremo/yaadon_ki_baaraat_movie_song_bestwap.pdfIn PDF document text
    • https://s3.amazonaws.com/gazitif/morse_sewing_machine_repair_near_me.pdfIn PDF document text
    • https://s3.amazonaws.com/wobuzisibal/nimuvozatelipesefereguru.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70adcb1a-3c9b-462b-b70e-0b5ba9df7f8a/kanafasebewaga.pdfIn PDF document text
    • https://s3.amazonaws.com/rijaliwiguvex/xotojafa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30eaba81-b063-4aab-ab27-f6be8dc285ec/principles_of_marketing_book_by_philip_kotler.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ed686f5c-914f-4229-bdbf-75c4bc3f9915/the_nun_2018_full_movie_online_123movies.pdfIn PDF document text
    • https://s3.amazonaws.com/jowutoneranemuk/11084799199.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00012fc8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x12FC8 24480 bytes
SHA-256: b826cdd61ec64cf154280bffe74412c7b0085e846833204c79d24a1d3da86061
font_00_sfnt_off0000f5af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5AF 5200 bytes
SHA-256: d88a57e1195ac86f281658cc3b513f6ab2d9bcc34489030eec7462907ee3855f
font_01_sfnt_off00010775.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10775 11844 bytes
SHA-256: 5ef365601e1b94b8f49e80c48fe1eaf0b2e9ffccafe25c33cbf8905d6c0b15fc

Open this report in the interactive analyzer, or submit your own file for analysis.