Malicious PDF — malware analysis report

Static analysis result for SHA-256 eaff8e79f96e65e3…

MALICIOUS

PDF

75.6 KB Created: 2020-12-18 20:15:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: fd67d3295cd030c8677ace6d45acd0ff SHA-1: 873f561e6a7137775496f2160d159681e43c2312 SHA-256: eaff8e79f96e65e32f6e802e1f410bb6c2903a8ad896b59fd5aa57dad3316777
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL that impersonates a government tax office, suggesting a phishing attempt to trick users into visiting a malicious site. No scripts were extracted, but the PDF structure and embedded URI are strong indicators of a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/strik?utm_term=forsyth+county+tax+commissioner+tag+office PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4426966/normal_5fba9b4b8d73b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369187/normal_5f93b27dd9b4d.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/ginutu/target_field_home_run_porch.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc36ab7a879396864183595/t/5fc6bc1dc953717e09c06c36/1606859805556/world_s_most_realistic_minecraft_texture_pack.pdfIn PDF document text
    • https://s3.amazonaws.com/donarepemi/83219241455.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2c6032e34347c70505203/t/5fc8904713de6e79815dc893/1606979656111/little_alchemy_losung_liste.pdfIn PDF document text
    • https://s3.amazonaws.com/godoremitiwuja/dejewa.pdfIn PDF document text
    • https://s3.amazonaws.com/pajeriramal/velijewejodapelobelufixuk.pdfIn PDF document text
    • https://s3.amazonaws.com/dazifozixawus/football_manager_2018_apk_real_names.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0f9ac5bcb0228a282ded2/t/5fc7851fb2fa4660c8d6d109/1606911264211/midijelus.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc695edc6229360ecd44eb8/t/5fd6a692d654060362d29973/1607902868297/apparently_j_cole.pdfIn PDF document text
    • https://s3.amazonaws.com/jexijer/soxutejulalozojokuxit.pdfIn PDF document text
    • https://s3.amazonaws.com/sixenogafopoj/dress_watch_size_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/pusumowi/we_re_the_millers_putlockers.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxenipup/blood_pressure_measurement_guidelines_nice.pdfIn PDF document text
    • https://s3.amazonaws.com/sikuva/modele_attestation_de_formation_en_informatique.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000db03.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xDB03 12112 bytes
SHA-256: 5bd946b18bf45e4ef37145f9e723486c75ccdf7b3b8d569b058d535109e7e6d3
font_00_sfnt_off0000c8cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC8CB 5388 bytes
SHA-256: 2f82e1745efe53c3a53120affe28676cca551aab25189a7479f837274f5eb7b5
font_02_sfnt_off0000fd65.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD65 10416 bytes
SHA-256: b039a5815b310039fb5792ea7d95d106264704745c5ef103366dbf78186a5768

Open this report in the interactive analyzer, or submit your own file for analysis.