Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9781f81a66d57fd…

MALICIOUS

PDF

70.6 KB Created: 2020-11-10 14:51:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: da3b30f146a5c9be076ffadf3c0e38bc SHA-1: e3cb1e4fef5fb2db9e0834dd079aa8c609d1a5d9 SHA-256: d9781f81a66d57fd26febe48421bbadfd4505068e1063af7a85c293bd01005da
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as Pdf.Phishing.Trojan. The embedded URL points to a site that appears to be a lure for downloading a driver, which is a common social engineering tactic. No scripts were extracted, but the presence of an external URI and the overall detection suggest a phishing or trojan delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?keyword=linksys+cisco+wusb54gc+driver+download PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a2178013-30f2-4500-91b9-9f4891f4c251/64263338581.pdfIn PDF document text
    • https://s3.amazonaws.com/sezebepit/marieb_lab_manual_exercises.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db98a7d2-2c0b-43ca-ad9b-a1d82f4a1a38/reresivovu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6128af5b-b125-4864-bca4-fabae90b020b/the_backyard_revolution_reviews.pdfIn PDF document text
    • https://s3.amazonaws.com/bepukuba/what_does_it_mean_if_a_mouth_swab_drug_test_turns_blue.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97cadfa2-08b1-4cf7-bb86-6df39806f55f/guzoweje.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6580332b-e517-4a9e-a082-fbfbde7dabb7/27680628818.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7266584a-62de-4f44-9be5-1ff9528d8528/pajikuduxadiganoxifu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db4fee2a-9e34-4a36-8279-d55527bdd8b9/sumiroxixojozotoximugeko.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac69b4b7-66c5-4e23-8dd8-90a9ece93709/sectional_anatomy_for_imaging_professionals_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5b8185d-2841-4db7-8dc5-d0b7796a72a5/zizemifixawiwixokizoxi.pdfIn PDF document text
    • https://s3.amazonaws.com/mejediparaxi/riduriberegulijeb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/486bf7eb-af0c-47b7-80cd-07f423c20f80/square_d_9013fsg_2m4_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/tedowafomaru/craigslist_toronto_canada.pdfIn PDF document text
    • https://s3.amazonaws.com/lorifumofelu/jubevopufupenapubume.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d4b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD4B6 5720 bytes
SHA-256: 58ecd6a95281d364d8f0064f5d5481e952271d81a5245c4341725345f30fd8ee
font_01_sfnt_off0000e870.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE870 10992 bytes
SHA-256: 7eb8415eb1542d5caaad4e59c6baae51d92551dc125069a5f167ab24b176c3c4

Open this report in the interactive analyzer, or submit your own file for analysis.