Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff5a0c79f28bd0e1…

MALICIOUS

PDF

153.1 KB Created: 2020-12-18 03:42:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 98679a2b1eaf7992480ff3ff3cfde648 SHA-1: c82768d4f06a827aa907da8253c52fbf839df7b7 SHA-256: ff5a0c79f28bd0e12dcee6446da836899da155771d188f2e8860c3d01927553c
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded JavaScript stream and an external URI pointing to a suspicious domain, identified by ClamAV as a phishing trojan. The ML classifier also strongly indicated maliciousness. The embedded JavaScript likely facilitates the redirection to the malicious URL, which is the primary indicator of a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=e3+chemistry+review+book+answers PDF link annotation
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc5b2678139af037665e521/t/5fd07fb1ab2d482295e0090e/1607499697863/41477449881.pdfIn PDF document text
    • https://s3.amazonaws.com/babuxufarizuxur/pinoy_henyo_words_lugar.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc13e7dd49dd12447366960/t/5fcb9b3d1df7590d80e2f24f/1607179070011/tolanate.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e170197e-d539-4a84-980f-a1fb75a9e02d/apricot_glazed_chicken_recipe.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc58e295687f52b6ba0bfae/t/5fcbf7e46f0099009e4d3d7b/1607202790998/expanse_rts_hacked_apk.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc112c117e7202640eb3140/t/5fc183aa3c02f22b9d4685c5/1606517675400/39204887483.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc53aa03398ff75154a37f3/t/5fd61098226e9048faad14aa/1607864472321/whatsapp_gb_terbaru_2020.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b0b1e872-0523-4b6d-a4cf-cbd994593233/peteniginaxiwesikasi.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc78c4d8651a047519888c5/t/5fd60b9c491a58544a07246f/1607863196718/xewomawiru.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd2f9ae1f2823a120621c0/1606234010644/2218394196.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001f38f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F38F 15292 bytes
SHA-256: 5154e00c28662d0aa4625aa1fd0b8e192a9e03e77973db9fee0373abf9666ac3
font_01_sfnt_off00021c2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21C2E 5588 bytes
SHA-256: 7e6a46ed35be9f29f743cbe66d1381ed46a12e2b8dc328908cce79c0fc4ca0e2
font_02_sfnt_off00022f22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22F22 11656 bytes
SHA-256: 1d4e1e35339dd5dbe5597a8258aa27f7087596dc43a9895d4a37188e836fd9e0

Open this report in the interactive analyzer, or submit your own file for analysis.