Malicious PDF — malware analysis report

Static analysis result for SHA-256 da797d37b253bfb6…

MALICIOUS

PDF

77.3 KB Created: 2020-12-18 13:41:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 9ab63c006f147b677dbf3d9453ff3583 SHA-1: 9f4dd01496b3b7c345a5afe3e99e369585b7c3b7 SHA-256: da797d37b253bfb69b038c1a98f6f9f501e18f0617176c8c0cc0be2c4752c317
162 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a malicious redirector link, identified by the 'PDF_MALICIOUS_REDIRECTOR_LINK' heuristic and ClamAV detection. The ML classifier also flagged the document with high confidence. Although no scripts were extracted, the presence of a malicious URL and the 'SE_DOWNLOAD_BUTTON' heuristic suggest the document's purpose is to trick the user into navigating to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?utm_term=taiwan+drama+app+for+android In PDF document text
    • https://cdn-cms.f-static.net/uploads/4419820/normal_5fbb977e1631a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420459/normal_5fd7cf610492a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380082/normal_5fc2b0e026c54.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374957/normal_5f9c6d5718fe2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368991/normal_5f89624b1e0cd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4473642/normal_5fb2c796da6f8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e947269-41f1-4a72-a50b-b15ce3c0c571/katon_housenka_no_jutsu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3d29551-66d4-467f-b995-80e1434fcc02/84360483925.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a9ce30b3-4100-49d7-a33d-b8ceb73513da/suma_de_fracciones_mixtas_mismo_denominador.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/41957d31-ace4-46e7-a57b-ee9966fdf518/78207427724.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea5b9f1a-d794-47a5-8910-936984e682a1/96744068389.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6a4c1c33-677b-4afa-ad6a-b2c2dcf23174/51097148965.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/31658568-3724-4252-b8f6-711340365ad9/8_ball_pool_hack_version_4.9.0_apk_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5f29ff9-cddc-44b2-948a-62b66cca1761/22966138450.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c5d2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC5D2 6680 bytes
SHA-256: cddec0bff3c2034555e33a0b96d70fc43e51adb44eb97f57e744d40232edc316
font_01_sfnt_off0000dc6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC6C 5016 bytes
SHA-256: b1cac2b5e1d901e92e38a32f1c331ec247fd6a0f4c42ea379b916ef5d7a9a5d1
font_02_sfnt_off0000ed7a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED7A 10944 bytes
SHA-256: 45e534ed3b225c38731c83baf8e2dcd2054011c41614830f3e5cbf4e857a2e4b
font_03_sfnt_off000112f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x112F5 16116 bytes
SHA-256: 8030cc4cfdde94770a8e713f169528216839a851581cd579368a53bb9c6b452d

Open this report in the interactive analyzer, or submit your own file for analysis.