Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5c97ff324b68897…

MALICIOUS

PDF

82.4 KB Created: 2020-12-18 03:41:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e1818179a049014dee219b2df6f4de9a SHA-1: 4cd3a45d2efbeb265b290eb9b6eec92e39171611 SHA-256: f5c97ff324b6889787b86e7b2d6c3b82fbed162a0a8108ccf9ea5585e919d2d6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. No scripts were extracted, but the presence of an external URI suggests an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9764

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=are+you+sleeping+in+korean+informal
    • https://cdn-cms.f-static.net/uploads/4412592/normal_5faf28b8c7181.pdf
    • https://cdn-cms.f-static.net/uploads/4446286/normal_5fd110e412696.pdf
    • https://static.s123-cdn-static.com/uploads/4465263/normal_5fc41711a3ae8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://static1.squarespace.com/static/5fc7a5e481da8a590db1d11e/t/5fcaf6cc64036b6143844e87/1607136973998/19571207523.pdf
    • https://static1.squarespace.com/static/5fc64b5b8ef7301f8b35b94f/t/5fcd10c5cded405bb8dda99c/1607274697620/ark_survival_evolved_beginner_guide_2020.pdf
    • https://static1.squarespace.com/static/5fc00a03c6229360eca839ab/t/5fc159373f75b1664306b346/1606506807557/german_curse_words_in_english.pdf
    • https://uploads.strikinglycdn.com/files/fd2c0aaa-3313-48e8-a815-d6be0d98c549/58711239414.pdf
    • https://static1.squarespace.com/static/5fc36151a13a450bab040bac/t/5fc83e6990a4f8549d714c53/1606958697827/micro_sd_card_reader_for_iphone_xr.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7e2.bin
f8754ceb7b350467893e20dd9dac22125ee43895b2e18b8b7f690e9820b52e71		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD7E2 15668 bytes
font_01_sfnt_off00010738.bin
8174de9741f920ad4a3f0da52dfc22fed6b79f3c3163c909484f1bff65ed48ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10738 5376 bytes
font_02_sfnt_off00011982.bin
34bea6a4263ffbb1e02c6eca6419ee2d46c50db50a4cacb5516f8dfc6d89786f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11982 10172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.