Malicious PDF — malware analysis report

Static analysis result for SHA-256 e73edcb9f8267f81…

MALICIOUS

PDF

72.3 KB Created: 2020-12-04 14:44:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 891511cd6695136194121a8e3f9adfde SHA-1: 852ca3f42d6ea0b6a09ccc05e33ae9c1c25c8e9c SHA-256: e73edcb9f8267f812f633a77e77d5c1d23fa6e21a92ca71af42ec8d2badfd649
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified by ClamAV as a phishing trojan. The document body, though heavily obfuscated, contains text related to 'Clicker heroes' and a download lure, suggesting a phishing or malware distribution attempt. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/strik?utm_term=clicker+heroes+unblocked+turtle+fish PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4380086/normal_5f9e8307c8205.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469119/normal_5fb7b8429874f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368240/normal_5f9287cfa305c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4443344/normal_5fb4b3ac9428d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378171/normal_5f9c292f960fa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/3de6d433-f1d9-4469-841e-13ddc01df5a1/dd_rick_and_morty_free.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc112aed26ff1194f74a888/t/5fc17e083570fb44d13b45af/1606516233052/longman_academic_reading_series_3_answer_key.pdfIn PDF document text
    • https://s3.amazonaws.com/gaxuremewuger/40496694531.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc27fb3239b0722913b63ef/t/5fc456433c02f22b9d97989c/1606702661485/marujetok.pdfIn PDF document text
    • https://s3.amazonaws.com/wamatasamegu/numopilogufexufex.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd109560d46713400584b3/1606226071871/961490844.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbffbf92e34347c703edab4/t/5fc1a5a1e18c5c478e399c47/1606526371028/lagufitizadifa.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a1a2dfcd-b89a-4886-a65c-326a7775d8bc/34455595728.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dcae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDCAE 5008 bytes
SHA-256: 59401e9103efd4c5898bd1924caa33a5963a1031eb4687f4ca8179aa91d1d448
font_01_sfnt_off0000edad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDAD 11344 bytes
SHA-256: f4e4b74733bae405de7d130e24f43a3ebcec38193f8ab5b2979af78a68899eb5

Open this report in the interactive analyzer, or submit your own file for analysis.