Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9074eb47e3da2f3…

MALICIOUS

PDF

76.4 KB Created: 2020-12-25 10:12:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-03
MD5: fdecc9afd7b85858943c4579a7da9074 SHA-1: fe095e95f8b431f1330883d11e894120a5d4a625 SHA-256: e9074eb47e3da2f37645f104334631bc4fcf5343203f637fcc77c27b8f46ea1d
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a malicious redirector link disguised as a Netflix APK download, which is a common phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were extracted, the presence of a malicious URL and the document's structure suggest it's designed to redirect users to a harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/aws?utm_term=latest+netflix+apk+for+android+tv In PDF document text
    • https://cdn-cms.f-static.net/uploads/4469831/normal_5fa7493b49d22.pdfIn PDF document text
    • https://cdn.sqhk.co/gemadaruvow/8fjdgie/limiraxumina.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370088/normal_5f88667671e53.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408720/normal_5fca60bf26c70.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413238/normal_5f96b6fb9de18.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4409396/normal_5fcc1eb7aaed2.pdfIn PDF document text
    • https://cdn.sqhk.co/bibunifez/iQicpji/nisidipiripubo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470977/normal_5fa58b5a8376b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/mesotodimus/burnham_alpine_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/zumezeviwakiz/26196948171.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/79167ab7-ad16-4db6-9fe2-108cf4ebd170/34201504534.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/667f84df-4019-4d0b-b7b8-7d009d9d152a/78903206170.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c05445c0-7f9d-42f5-8c34-f8ec62e57113/38258965180.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9965c0c9-1663-4e46-a937-7e8866cbc76b/bbva_compass_paysource_number.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7706db45-c281-4113-b06c-22d44e0d7d02/43769086719.pdfIn PDF document text
    • https://s3.amazonaws.com/mefadedosuw/furidabogetanazuxojem.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF00 5168 bytes
SHA-256: 7ac2a74dc131a4aa6c13006a623d5f01857c350e93c55c0a5b95c1e87ee527e9
font_01_sfnt_off000100b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100B5 10608 bytes
SHA-256: fc7962ce7d6de1d12bf1489882e74a97660d8ccc43e996fcbbddf0d257b0769a

Open this report in the interactive analyzer, or submit your own file for analysis.