Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c769d13f3c4f24c…

MALICIOUS

PDF

76.4 KB Created: 2020-12-16 22:17:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 78a5ec2d1a7be1a94ff6e93ceed56e4d SHA-1: 1b4d0d0c79ebf5d06d0e71677f67a4e819cd4f65 SHA-256: 1c769d13f3c4f24c3c96b9f71c1ece4487bd75a803928ae6344fbd5aa1f68f40
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that leads to a website offering body armor for sale, which is likely a lure. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as a phishing trojan. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest a phishing attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/strik?utm_term=dragon+skin+armor+bulletproof+vest+for+sale
    • https://cdn-cms.f-static.net/uploads/4413475/normal_5f9b399778f54.pdf
    • https://cdn-cms.f-static.net/uploads/4473916/normal_5fa9df017c7db.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/fb63f53a-fd17-4ccc-a581-097522ce3133/7106186135.pdf
    • https://uploads.strikinglycdn.com/files/81c94908-db18-4bdf-b122-ca446dcec8d9/sembaruthi_serial_song_nenjodu_kalanthavale.pdf
    • https://static1.squarespace.com/static/5fc56ff188c99b6d37c5dc1c/t/5fc61ced3c6ccf69f3300d0b/1606819059485/samsung_s8_live_wallpaper_free_download.pdf
    • https://static1.squarespace.com/static/5fc787b65c272238a81aab02/t/5fc98c5d81b71b40858daa7d/1607044191115/commander_collection_green_pre_order_amazon.pdf
    • https://static1.squarespace.com/static/5fc109f45e8e827d428e9438/t/5fc622443f75b16643a59f4f/1606820427373/fefevidumezijidogapel.pdf
    • https://uploads.strikinglycdn.com/files/a84ac3ee-5d2c-4505-a3f3-87d325e6ab41/nadodisuxijaxajapoz.pdf
    • https://uploads.strikinglycdn.com/files/ab9e41fd-3370-4134-bfef-12a3738ff69b/42503781948.pdf
    • https://uploads.strikinglycdn.com/files/413dda69-a03a-453f-9359-d15b349c1d19/73296264722.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebc9.bin
014a1265681d417b1729593e03506cef5cbb3338fb1ad1489b759d2cab84f11d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBC9 5484 bytes
font_01_sfnt_off0000fe6c.bin
7071be3f3d1d0dc8d26927a0dd9f10d78ca21f00abdb29a5599ce24710a44283		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE6C 11180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.