Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbaae57d0673f173…

MALICIOUS

PDF

115.5 KB Created: 2021-05-29 03:59:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: 34d1ec357046ce39eb60aaa34962f20b SHA-1: a99f01b29013c08b56f1473094570e2d5844af3e SHA-256: fbaae57d0673f17370ae8ccef96e45112c579d81cd24545223583cf82d1f74ea
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, appears to be a lure related to a book title, suggesting a targeted phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=christopher+alexander+pattern+language+amazon PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4491169/normal_600f58d5e3639.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370278/normal_60404a139f560.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4368251/normal_60b17de3d9fd8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4485576/normal_6005ec3e0469e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468836/normal_6026b944be107.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4407749/normal_5fed7276494c8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4486994/normal_6004ed6971be3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421051/normal_606e197bbe8d5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4492900/normal_5fd923f127c27.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4502236/normal_603fdd7e35a0e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371791/normal_602620d3af103.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451021/normal_5fe75c987106b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458389/normal_5fd7b2cf712bc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373755/normal_5fdb6f1833f83.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4448357/normal_5fdd6f6aa8630.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4472494/normal_60465a5462a75.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4458829/normal_60014a3ede5c3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386347/normal_60446e568b866.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4418786/normal_6051b24c62f8c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468531/normal_6021f99b07a1d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4380525/normal_5ffe6fd3e1b26.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376856/normal_600dc31b7dce0.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4493245/normal_5ff4b75c97dc0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369519/normal_606ae91cd2d75.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017eaa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17EAA 5396 bytes
SHA-256: 5454a57a74eda0a32b465e1703077cc0071e5bfdc028c3fa47a0236e13ee3395
font_01_sfnt_off000190e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x190E0 15252 bytes
SHA-256: 9a3f29414ec69aa84175575ce37b236bb4f44c59066564a72c7b648fefc43508

Open this report in the interactive analyzer, or submit your own file for analysis.