Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c2ee1ee30908475…

MALICIOUS

PDF

68.7 KB Created: 2020-12-17 08:44:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4d99507b0ad773acf713d8895a41ea76 SHA-1: d734989c093a6e0d38086c4562098b8d65a0482d SHA-256: 1c2ee1ee309084754c9b74df15391fe33b6a28f4b3befb88aac52ebc1d0c3ebf
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'traffking.ru', which is a known malicious domain. The document body, though heavily obfuscated, suggests it is intended to deceive the user into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/strik?utm_term=cause+code+97
    • https://luvikexixof.weebly.com/uploads/1/3/4/4/134481561/vabagunefilavewo.pdf
    • https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/divili_dapixi.pdf
    • https://cdn-cms.f-static.net/uploads/4403404/normal_5fbd658d4427d.pdf
    • https://cdn-cms.f-static.net/uploads/4390642/normal_5fbfb583170a9.pdf
    • https://kakejomoweva.weebly.com/uploads/1/3/4/6/134674311/wewefiloletuza.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/981084ce-fe41-47a5-a07b-8717456b8119/bissell_86t3_user_manual.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf5851145a8629dca8205f/1606375506654/how_old_is_kate_in_annie.pdf
    • https://uploads.strikinglycdn.com/files/f4d35af6-0649-4ccc-ba3b-6f38f0e3d3f2/4562242481.pdf
    • https://uploads.strikinglycdn.com/files/39c9bdf6-b083-48e3-9fee-671c75764ec7/85090986822.pdf
    • https://uploads.strikinglycdn.com/files/15383e9a-9be2-4b70-8745-f1f30958a4b9/kaxuruwabibumefivuxasogol.pdf
    • https://static1.squarespace.com/static/5fc11d1c2bbd74065807c487/t/5fccdd052fa8bc6bcde8679c/1607261446584/hospital_ward_or_room.pdf
    • https://uploads.strikinglycdn.com/files/03f35c2f-3a5e-4e2b-a169-691c75a9d3cd/vopog.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d2b9.bin
e06b29a3b62332c560bef6944e31f96d2721a7f9838998cfe46e54cf27599a96		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD2B9 4944 bytes
font_01_sfnt_off0000e39e.bin
30e4756001d1cc3ff469419c3b0ff8f1c4c84163809b597f7e74be1261a399b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE39E 10276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.