Malicious PDF — malware analysis report

Static analysis result for SHA-256 12dee7c3e7c58de8…

MALICIOUS

PDF

74.5 KB Created: 2020-12-26 18:44:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1f992b12ddcc929f33e55f53c7726e01 SHA-1: d5272e9140f93eb796fe346db0e639ada62d90d5 SHA-256: 12dee7c3e7c58de8c08ed0bdad9bba48e2b8bd7577ff277ed43d193719afa529
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL, identified as malicious by ClamAV and an ML classifier. The URL 'https://traffset.ru/123?utm_term=can+dogs+have+salt+vinegar+chips' is the primary indicator of compromise. The PDF structure and embedded content suggest it's intended as a lure, likely for phishing or to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=can+dogs+have+salt+vinegar+chips
    • https://cdn-cms.f-static.net/uploads/4403541/normal_5fac532947350.pdf
    • https://static.s123-cdn-static.com/uploads/4411932/normal_5fccab7dacb27.pdf
    • https://jaketomerinojox.weebly.com/uploads/1/3/4/1/134109184/powubepuxuxuju.pdf
    • https://cdn-cms.f-static.net/uploads/4402724/normal_5fa6b28443557.pdf
    • https://cdn.sqhk.co/zowesifona/bumJGhi/mivulupesowot.pdf
    • https://mubewawabover.weebly.com/uploads/1/3/4/4/134465459/senivaxifop-gemud.pdf
    • https://cdn-cms.f-static.net/uploads/4466391/normal_5fa596da99d9e.pdf
    • https://static.s123-cdn-static.com/uploads/4495976/normal_5fe07eb127a21.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/c87621cd-7937-4ed8-8901-c27edd43c06b/56379760669.pdf
    • https://s3.amazonaws.com/sivanira/6_pulgadas_a_centimetros_altura.pdf
    • https://uploads.strikinglycdn.com/files/cc8e7fe7-9bf0-40ae-92d4-434364318c5c/visovasesixumif.pdf
    • https://uploads.strikinglycdn.com/files/2c1a6c8d-3af7-4380-adb1-dc36deed8f3b/east_jordan_iron_works.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000da38.bin
92b32dc4d1b0988869d841920f85be21f5c68b7511bfc792cb894d8cb827956f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDA38 5208 bytes
font_01_sfnt_off0000ebf5.bin
8c1d303daeff94d1060cf8d14f4030e604f03700367b7b7d1de5b1a15bcb16be		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBF5 10300 bytes
font_02_sfnt_off00010f3b.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F3B 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.