Malicious PDF — malware analysis report

Static analysis result for SHA-256 ebd8fbcc2e503130…

MALICIOUS

PDF

67.0 KB Created: 2020-12-21 08:52:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: c946ba7f31bf646436466529ef4cb663 SHA-1: 164c3c2d7311db966d4e6f66b1f74aca160de667 SHA-256: ebd8fbcc2e50313050096c93d765e8e3c6b76979c8a6610680a4f6fd8d19be3f
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, which is flagged as critical. The ML classifier also strongly indicates maliciousness. The document body, though heavily obfuscated, appears to be related to the URL's deceptive content. The primary IOC is the malicious URL used in the phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/strik?utm_term=how+to+change+lock+screen+wallpaper+laptop In PDF document text
    • https://cdn-cms.f-static.net/uploads/4403282/normal_5fb6448161d10.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zifozujiwi/august_2019_current_affairs_adda247.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fde88431076b30d0a95c29a/t/5fdf55177f4e6a336732cb13/1608471832703/caricatura_politica_en_mexico.pdfIn PDF document text
    • https://s3.amazonaws.com/gezetega/9111418324.pdfIn PDF document text
    • https://s3.amazonaws.com/ziwuvijevo/animation_creation_software.pdfIn PDF document text
    • https://s3.amazonaws.com/wiwuxot/android_emulator_game_boy.pdfIn PDF document text
    • https://s3.amazonaws.com/fekaduvopigab/bechdel_fun_home.pdfIn PDF document text
    • https://s3.amazonaws.com/sugosubexez/nachiketa_new_song_2019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/43ccf251-d6b7-402d-9e1d-10b74aecf07b/79463839635.pdfIn PDF document text
    • https://s3.amazonaws.com/suzixegazunow/shadow_fight_2_apk_hack.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000caaf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCAAF 5312 bytes
SHA-256: 369704fad5e9484c739449382adfa9ee21c01dec4e900ac64e667102e3970387
font_01_sfnt_off0000dcd2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDCD2 10016 bytes
SHA-256: 97f0d417506e0b333c9b4782f225b0413868c4e966cfb5aa836c7a19ac99d739

Open this report in the interactive analyzer, or submit your own file for analysis.