PDF static analysis report

Static analysis result for SHA-256 f4c6808717371691…

SUSPICIOUS

PDF

41.2 KB Created: 2020-11-05 23:02:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 44cf29199aaa72715874d3998bcf3623 SHA-1: 1d50223010b7f201e3c73cbe87cbc8fc22ef8153 SHA-256: f4c680871737169189deed5cfa70d437673cbee8d85d8c513fe3a93846196be1
36 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URL that, when clicked, directs the user to a domain associated with malicious activity. The ML classifier strongly indicates maliciousness, and the presence of an external URI suggests an attempt to deliver a secondary payload or redirect the user to a phishing site. No scripts were extracted, but the embedded URL is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/aws?keyword=youtube+app+apk+2020 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4393016/normal_5f9a2fc652a72.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403673/normal_5f9c768d0dc03.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408336/normal_5f9a10e0eb13c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371265/normal_5f964f6cad6ec.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xanebavifamopez/tafupoxad.pdfIn PDF document text
    • https://s3.amazonaws.com/zirojopemup/anemia_aplasica_clasificacion.pdfIn PDF document text
    • https://s3.amazonaws.com/migivewuwe/46898395743.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a49c5499-79a5-4645-ac3f-d2483c47a7ba/wyandotte_county_recorder_of_deeds.pdfIn PDF document text
    • https://s3.amazonaws.com/nefagolom/life_and_death_twilight.pdfIn PDF document text
    • https://s3.amazonaws.com/bajuse/mems_accelerometer_sensor.pdfIn PDF document text
    • https://s3.amazonaws.com/tibanepoxilibud/bureaucratic_style_of_leadership.pdfIn PDF document text
    • https://s3.amazonaws.com/tujeviwakirawu/lafoxewafuwerelazeweze.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4fa24e7c-e497-4afe-9a35-c27c0104a24c/jivisuwafuxorujawiga.pdfIn PDF document text
    • https://s3.amazonaws.com/bewibiwat/56365020586.pdfIn PDF document text
    • https://s3.amazonaws.com/wilugugo/95389164054.pdfIn PDF document text
    • https://s3.amazonaws.com/gowebabuxogiro/maxewenulotumakesupobe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005ad1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5AD1 4948 bytes
SHA-256: b3ab724cac093ed18e145d538ed87af124df90daa75d9dca17b2a603ffc05739
font_01_sfnt_off00006bb7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BB7 1912 bytes
SHA-256: 5ffeb62cc735427a844e4fc30fe3f408afa3be4b10dd737b69049c1a099b5cd9
font_02_sfnt_off000074e4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x74E4 10232 bytes
SHA-256: 23fb117180f616ab68672d297b7333087c0a816438034f28bf10aa75aa60b48e

Open this report in the interactive analyzer, or submit your own file for analysis.