Malicious PDF — malware analysis report

Static analysis result for SHA-256 02a881c1db9fe835…

MALICIOUS

PDF

152.8 KB Created: 2021-01-25 00:58:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 463d11c6b6148038f54bd202b4a2a143 SHA-1: 94be375273f0546f640576225367bf1c21db9dc1 SHA-256: 02a881c1db9fe835acdf4db263afaf5adeee73dac9c71f6d37217904abd0ecc8
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a critical heuristic firing for ClamAV detection. It contains an embedded URI pointing to 'traffset.ru', which is likely a phishing or malware distribution domain. The document body is heavily obfuscated, but the presence of the external URI and the overall malicious verdict strongly suggest an attack pattern involving luring the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=levi%2527s+sons+in+the+bible PDF link annotation
    • https://cdn.sqhk.co/zovaratigu/hcigIid/6443399189.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454277/normal_5ffcb33d4c09b.pdfIn PDF document text
    • https://cdn.sqhk.co/fobonelaga/cNhiOjj/terry_kiser_weekend_at_bernie_s_3.pdfIn PDF document text
    • https://cdn.sqhk.co/velabolo/fiiehgX/maze_runner_movies_free_online.pdfIn PDF document text
    • http://xotizel.iblogger.org/greensleeves_flute_sheet_music.pdfIn PDF document text
    • https://cdn.sqhk.co/madagijoj/if9Aiee/kubaxerixezuwuxalumir.pdfIn PDF document text
    • https://cdn.sqhk.co/nokotadi/6kjevGA/slice_of_veal_crossword_puzzle_clue.pdfIn PDF document text
    • https://cdn.sqhk.co/gimexigerub/phhgijc/uefa_champions_league_2019_results_and_fixtures.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4490269/normal_5fc9b498d86d1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501645/normal_5fe77f8d6c258.pdfIn PDF document text
    • https://cdn.sqhk.co/kagalitisup/n3gdzmk/nuzuvoxexujujupaloxo.pdfIn PDF document text
    • https://cdn.sqhk.co/nenakowi/wljjJsu/vampires_wife_cape_h_m.pdfIn PDF document text
    • https://cdn.sqhk.co/wozepefiga/4gbNhfE/85201479552.pdfIn PDF document text
    • https://cdn.sqhk.co/fewisezux/ihjjn9A/75844461829.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4416500/normal_5fc7f1817b843.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jumedemimo/amazon_platform_as_a_service_pricing.pdfIn PDF document text
    • http://givemuzod.epizy.com/babul_shooter_game_app.pdfIn PDF document text
    • http://tinejamuwaki.epizy.com/69048824297.pdfIn PDF document text
    • https://s3.amazonaws.com/medaliwifufugel/mowutimosebezotudiki.pdfIn PDF document text
    • https://s3.amazonaws.com/tenunud/fokoxefewologasaxik.pdfIn PDF document text
    • https://s3.amazonaws.com/rafiralexezol/second_language_teaching_methods_and_approaches.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001f69c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1F69C 4644 bytes
SHA-256: 0d0493e4fcb2fa479d26236424f3c74436d9a999123cb32693680669503fb82f
font_01_sfnt_off00020678.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x20678 19048 bytes
SHA-256: 8cbe6875e7c0510f14fa825e6154bf4a7ac695467bfcddd5a3c0a189b537c1fe
font_02_sfnt_off00023fd5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23FD5 16164 bytes
SHA-256: e428de66ceb9deebdb53ebe71febfe16dde38f113f03500bd416f391f33c23f3

Open this report in the interactive analyzer, or submit your own file for analysis.