Malicious PDF — malware analysis report

Static analysis result for SHA-256 055f60c2eacbe5ad…

MALICIOUS

PDF

80.4 KB Created: 2021-01-24 21:39:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: cb2effb7c367fbd503cda52464f48518 SHA-1: c2f93d86053d5d245512d28dd692b748cf62c76d SHA-256: 055f60c2eacbe5adfc5a62c78c4a0c682babdce8230f06ac2c8c593cb8a3e521
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating the presence of an external URI. The document body, though truncated, contains text that appears to be a lure. The primary malicious indicator is the embedded URL pointing to 'traffine.ru', which is likely used to deliver a secondary payload or conduct phishing. No scripts were extracted, but the PDF structure itself facilitated the malicious URL embedding.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=light+up+hula+hoop+uk PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4482218/normal_5ffc08265aa42.pdfIn PDF document text
    • http://static-get.top/8892100726pjkkh.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426415/normal_5fe99ed5b3838.pdfIn PDF document text
    • http://adminhalil.com/zawusixfkx.pdfIn PDF document text
    • http://buloshnaya.site/hockey_manager_2020_pcpbhhp.pdfIn PDF document text
    • http://organicsss.space/agent_ransack_download_macy6l46.pdfIn PDF document text
    • http://1xbet-regi.site/31550592942q3zky.pdfIn PDF document text
    • http://hiziryigit.online/jobodu1m2ra.pdfIn PDF document text
    • http://lg-supportteam.com/tai_tiny_battleground_apkhd8a8.pdfIn PDF document text
    • http://yudekor.ru/samoridagotekitusaznes.pdfIn PDF document text
    • http://mercelus.xyz/nizewiwipuxidozonaguxieatmk.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/zukogi/gedanawuxojow.pdfIn PDF document text
    • https://s3.amazonaws.com/kotenu/t_shirt_mockup_psd_file_free.pdfIn PDF document text
    • https://s3.amazonaws.com/xutomoxu/chori_chori_chupke_se_aake_song.pdfIn PDF document text
    • https://s3.amazonaws.com/julexekubaj/what_are_your_hobbies_interview_question_answer.pdfIn PDF document text
    • https://s3.amazonaws.com/saxefi/pubg_lite_pc_tanpa_emulator.pdfIn PDF document text
    • https://s3.amazonaws.com/jinabisura/17884271633.pdfIn PDF document text
    • https://s3.amazonaws.com/kujapomib/19155908612.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fdde.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDDE 4812 bytes
SHA-256: 189ce1cc5dbab34910b6de4804d114e8802a63f585e94ed4091fc1d2403bd381
font_01_sfnt_off00010e49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E49 11172 bytes
SHA-256: 133c646daafbf74fc20346688b08912b24fcc27c603d344769188e8f9208263f

Open this report in the interactive analyzer, or submit your own file for analysis.