Malicious PDF — malware analysis report

Static analysis result for SHA-256 f082be0cc5129512…

MALICIOUS

PDF

67.7 KB Created: 2020-12-18 04:43:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: d5e0181c36d38e71b4886da1f735568f SHA-1: cbdd3bf1d86b43e87a1ad07cb3dec7693b859990 SHA-256: f082be0cc5129512c54953c0a746c835b96c3bc367058d9ec9fa8b0a44f5b612
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. ClamAV detection and ML classification strongly indicate malicious intent. The document body, though heavily obfuscated, contains text that appears to be a lure related to 'Oak hill basketball players'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/strik?utm_term=oak+hill+basketball+players PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4495262/normal_5fad3b9d83db0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445880/normal_5fd2d9d5b0afe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476453/normal_5fb94c77f1bf1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426557/normal_5fb373814c1de.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc117c3a3bf4b14abaa53c7/t/5fc8a617a9f67830ca003949/1606985239768/telegram_definition_and_examples_of_metaphor.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2a774c6d96458362d6425/t/5fc806a15911716818abfa7d/1606944417705/world_war_11_timeline.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1a765405d5340f32ee4e2/t/5fc2ea7a08845d0924ea6c43/1606609530723/football_logo_quiz_answers_level_4.pdfIn PDF document text
    • https://s3.amazonaws.com/xukirizugukugi/26302588525.pdfIn PDF document text
    • https://s3.amazonaws.com/gasodamuza/ruxafefuvorused.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0f6bd5687f52b6b817d01/t/5fca2f69e4017829c1744d10/1607085929856/block_tank_wars_2_mod_apk_download.pdfIn PDF document text
    • https://s3.amazonaws.com/ximupuv/satato.pdfIn PDF document text
    • https://s3.amazonaws.com/xapidajovaji/60540590726.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cdbf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCDBF 5240 bytes
SHA-256: 52f0b5383c5480d6ff25d691bfd4b42189e1331578c123341152f712d9e12cc8
font_01_sfnt_off0000df87.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF87 10252 bytes
SHA-256: e0c6327af1ea5664824aa26646a8e024bbe72dd40de12ae5259d09c729bf7ddd

Open this report in the interactive analyzer, or submit your own file for analysis.