Malicious PDF — malware analysis report

Static analysis result for SHA-256 146a6d103a1b53ac…

MALICIOUS

PDF

92.1 KB Created: 2020-12-21 06:04:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 129b64517f6beb00eca7d1f541c13ce3 SHA-1: 61273eefa6ea68f43b75976271960388dde09669 SHA-256: 146a6d103a1b53ac2689acc357facaf468c6b85f97b581daa3d52de7d1e32c51
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, indicating a phishing attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. The document body, though heavily obfuscated, contains text related to 'sprint account upgrade', reinforcing the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?utm_term=my+sprint+account+upgrade In PDF document text
    • https://cdn-cms.f-static.net/uploads/4425211/normal_5faa67fd662cd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378378/normal_5fb8416146e49.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454051/normal_5fbb2fff54883.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4411273/normal_5fdf820849f65.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365547/normal_5f9de15ade1ec.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424010/normal_5fba719b4a9da.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gumagabu/turuvugasidoraro.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e0d3056-4add-4228-9c59-07c050dadb49/kobold_scale_sorcerer_5e.pdfIn PDF document text
    • https://s3.amazonaws.com/rizijubovapuk/patient_self-determination_act_psda_definition.pdfIn PDF document text
    • https://s3.amazonaws.com/zonebon/febamikubexi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6dd2d86b-5166-4015-aac9-57d8ce152f3f/60854191613.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4f86a97599144eede41e/1606373255324/how_to_find_the_intersection_of_two_lines_in_3d.pdfIn PDF document text
    • https://s3.amazonaws.com/zopenave/pafizinug.pdfIn PDF document text
    • https://s3.amazonaws.com/vuzotisenixava/microscopio_optico_partes_y_funciones.pdfIn PDF document text
    • https://s3.amazonaws.com/zepifudoxapo/canoscan_lide_210_setup_cd_rom.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d89a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD89A 17808 bytes
SHA-256: d30eb10409a411a6d3bc5e476c48acd6593e43f2485d3d0ff61caad91df0bc51
font_01_sfnt_off0001112d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1112D 5316 bytes
SHA-256: 23fb83e4c95b295d3eff723c11f72b1cb75ff2a19da7ab2910dcfc74be816e43
font_02_sfnt_off00012362.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12362 11252 bytes
SHA-256: 4a58ab924b812e06263adac152cba74f56c9007286bb97dbfc50c0d39aa77070
font_03_sfnt_off00014a04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14A04 16548 bytes
SHA-256: aeff1673b7a317cda2befc6fcded82725d9d8a7d115c99dcf9920f6f17bd8330

Open this report in the interactive analyzer, or submit your own file for analysis.