Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ea8013be434a313…

MALICIOUS

PDF

71.0 KB Created: 2020-12-24 14:07:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 3fccc96dbeee4e17c9906296db794dc4 SHA-1: 8a5d7ad3fcd5e7d56e3c25c3e677edd9c1c12612 SHA-256: 1ea8013be434a313adffdd5cf35320ffd84fb1506e45efd68dd2d48c7be32e8d
116 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by multiple heuristics, including a critical ClamAV detection and an ML classifier. The embedded URL, https://trafftec.ru/123?utm_term=cnpgd+watch+phone+manual, is likely the primary payload delivery mechanism. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest it's designed to redirect the user to a malicious site, potentially for phishing or further malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=cnpgd+watch+phone+manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4426263/normal_5fc183188a61b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/df26e7fd-7e31-43d4-93e6-6d5547f55aa8/inspiron_one_2020_hard_drive.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8540352d-25b7-4db4-b783-97af7294d82b/introduction_to_management_science_5th_edition_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55d77636-d642-49d4-8c97-e4a6fb5e9c71/juximesevoxewokaxuvakana.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/58e801f7-b75a-41d9-86cd-e9693a274598/65478946821.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa19bdcd-e40c-4cc2-93a9-8f517a41a015/68685176057.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/be3d2478-7d90-42f0-bc53-29404f91a344/puxajuwomamu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b7ebebb-6565-4fb6-b903-59c2a4627ac8/chemistry_limiting_reagent_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/mubemutolewe/manual_tecnico_del_cultivo_de_arveja.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73694c3a-b42a-4ee6-916f-98bdb92358f5/45330541715.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1fd701c5-9668-47c8-ad91-29b17741c413/pavojenojelisezeb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6fb932b-a614-491b-8521-c3b14dfc4d51/the_young_elites_epub_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d92c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD92C 5212 bytes
SHA-256: d48a0b59837589a8cc758928ea4f588b597dd8d609f2eaac094427c587cc3514
font_01_sfnt_off0000ead4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEAD4 10708 bytes
SHA-256: f3bfdae56c80b51baa4d8ece9c8780dd563ec6f138324a8d937112a68c0a6833

Open this report in the interactive analyzer, or submit your own file for analysis.