Malicious PDF — malware analysis report

Static analysis result for SHA-256 05f15b7fa508b5b6…

MALICIOUS

PDF

66.2 KB Created: 2020-11-18 10:31:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: c74fba78c1c259d4c628da76b3d6ff0b SHA-1: 95234fc03fb9e401ce068978137bccfea6fc171c SHA-256: 05f15b7fa508b5b65fcad3f51118d3fdfd6685652db616db4c1c45b69655b674
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The embedded URL, 'https://trafficel.ru/aws?utm_term=free+metronome++for+windows+7', suggests a lure to download a file disguised as a free metronome application. While no scripts were directly extracted, the PDF structure and the nature of the URL indicate a phishing attempt designed to trick users into downloading malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=free+metronome++for+windows+7 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4369908/normal_5f89797c5daf1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388818/normal_5f990d1b649ea.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366642/normal_5fa0ac3c6e4d9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366405/normal_5fadc20dc381b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488317/normal_5fafa364b6c51.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b9e2b13f-da2b-4de3-af69-1b626d959eb9/48404789264.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a5c55ab-1ba0-476d-a6e8-bb39efdbd1f7/stamford_elementary_school_vermont.pdfIn PDF document text
    • https://s3.amazonaws.com/jefobexapulow/wumavi.pdfIn PDF document text
    • https://s3.amazonaws.com/lodazojamuva/jojegid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8bcc1293-8c4c-4e53-9e5d-21e63838c344/vukufebumolivisasu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3fa1ea4e-ed98-4692-9593-481e18392f83/wuwikojunuzakuwesuxirora.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5689a74-a80d-4d8f-9d71-82b94a83a212/77566075209.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bfd60b95-eebd-4ef8-b6a9-44c91e3d4b70/51336753718.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c507.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC507 4936 bytes
SHA-256: 74a1652cb31a0cf8f66cbc601b8bc520e58c871f3236991b1189b6092d8b506b
font_01_sfnt_off0000d5db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD5DB 10792 bytes
SHA-256: 56fb2f3f2022c691a84ecd0adc5de86b0eea13b6c1f15acae679bbf63b719b27

Open this report in the interactive analyzer, or submit your own file for analysis.