Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc0b7edb3a82c3ad…

MALICIOUS

PDF

77.2 KB Created: 2020-11-30 15:42:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04
MD5: 01ed725752b606428351c1c50d1ce93d SHA-1: b0157c6029cedd59c946b01795c7358324cd086e SHA-256: fc0b7edb3a82c3ad31dde045b6d017fbc16fa973154fac98bcefc82fb829e3e4
162 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file routes users through malicious redirector infrastructure and presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?utm_term=cubase+7+crack+activation+code In PDF document text
    • https://cdn-cms.f-static.net/uploads/4406454/normal_5fa05137e9f42.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383340/normal_5fa5e79632122.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393036/normal_5f95e4bc8a125.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380392/normal_5f8aea06a2fa7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416938/normal_5f9e50733f51c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468828/normal_5fb69a30e06e1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370097/normal_5f9b91925ebf0.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc18272ff13940aa243ecad/t/5fc3264ebc819f1cf43febb7/1606624847358/escuelas_de_real_estate_en_espanol_miami.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0805cd49dd12447321748/t/5fc173c0a97599144e2e2f02/1606513602411/entrepreneur_jack_ma_book.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0d7ac403f5353fd956fc5/t/5fc29e6f145a8629dc062feb/1606590064749/namimelufupokikuwikutane.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/473c5e93-af32-4f6d-967b-5efb1328680e/pavabefejowufaga.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0c991c6d9645836219624/t/5fc0dfac61e25426e1588eda/1606475697666/75434430618.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4bc45147b148042966e8/1606372301077/rca_blu_ray_home_theater_rtb10223_manual.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0feaf0a2757459be36412/t/5fc2ee78145a8629dc11aed1/1606610552616/musilikafusitunix.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000d796.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xD796 12600 bytes
SHA-256: d1f8747dd1d9781cd1a30d60f9d79810e1ec3a71b8a25d386d33f455625f2e9e
font_00_sfnt_off0000c607.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC607 5152 bytes
SHA-256: ddc57dfb86904ce1ee96487e42b06ed12c0369a216805b9cde57da1bc4f77b67
font_02_sfnt_off0000fb5e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB5E 13132 bytes
SHA-256: 6ac6b599749b69f3f5767634c8a3c40d7bab1128c7ee816dfe372224577ed50c

Open this report in the interactive analyzer, or submit your own file for analysis.