Malicious PDF — malware analysis report

Static analysis result for SHA-256 21f04341d2a38c29…

MALICIOUS

PDF

81.4 KB Created: 2020-11-09 18:06:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 3de1980a163429146ff08b24b70a8d6a SHA-1: 19a02b7a09f51cfcaa1d2a1cbcdfb0c9602a30fd SHA-256: 21f04341d2a38c29c5baa97e03a7dd53d954c8b62ed8242596a7b56a0652533a
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://traffmen.ru/123?keyword=cam+icu+delirium+pdf'. This indicates the document is designed to lure users to a potentially harmful website. The ML classifier also flagged this PDF with a high probability of being malicious. No scripts were extracted, but the presence of a malicious URL strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffmen.ru/123?keyword=cam+icu+delirium+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4366952/normal_5f9bf1f420b16.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413118/normal_5fa238dfbdd86.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6fe512e7-16ad-4ab6-b6fc-f372548a6613/13133658012.pdfIn PDF document text
    • https://s3.amazonaws.com/mozirolinitaje/kiwoxuv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/343e5190-4609-449c-b62d-5fb7910f0aa1/midejir.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1c31b38-7afe-4c8d-8618-aed2fe323859/nfs_underground_2_modifiyeli_tofa_yamas_indir.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/740d1515-1555-4636-81db-c0df4d7f9789/69729924314.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d1f7774-919e-48de-a67f-fbece364a27e/43182192192.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b85210c3-c572-4ee5-bbaf-fcb88ef6daf5/kawivovasebotatusajaveg.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2be75f42-b2a0-450f-8418-eb5455fde836/raragesevusikiminerike.pdfIn PDF document text
    • https://s3.amazonaws.com/forupokisip/high_school_algebra_2_test.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/78f0e2c5-08fc-4de2-9bb5-39343bd2415c/diarios_de_vampiros_1x1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02bd0f80-6a22-4efe-a975-bdd14815271e/misefofanozopunatafe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/294b371d-2fe8-4975-b4c3-9c7b3b9daad8/lawizukoves.pdfIn PDF document text
    • https://s3.amazonaws.com/bejideba/ti_nspire_student_software_crack.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e05e70e-7892-4215-8080-3975933ee03d/zexikinijawajalalilora.pdfIn PDF document text
    • https://s3.amazonaws.com/saxefi/destiny_2_rasputin_key_fragments_not_dropping.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00011c30.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11C30 18116 bytes
SHA-256: 79f69753e178c3b058b041aca2ba198602ae423d720a1791ce8a16e69aa42ba5
font_00_sfnt_off0000e354.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE354 5028 bytes
SHA-256: 22d8c7bfec9939890b804ad3df2f896ff7684a6ecfce8a6e88646b33fa861d7f
font_01_sfnt_off0000f455.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF455 11644 bytes
SHA-256: 309ee9e0f4df334283d1168b70e94a4a867dfac27474de7eb0951cc81c9bb38a

Open this report in the interactive analyzer, or submit your own file for analysis.