Malicious PDF — malware analysis report

Static analysis result for SHA-256 2212109d44ad3790…

MALICIOUS

PDF

73.5 KB Created: 2020-12-25 22:28:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 6cfa11022c40a5022d1b48dfe9f402cd SHA-1: bbc22f396add6cd9331568e660d9a87397030354 SHA-256: 2212109d44ad379086661179346932f1800a6396fff0a3b7c40ef34f0dd8775e
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically identified as a phishing trojan. It contains an embedded external URI pointing to 'trafftec.ru/strik', which is likely the initial stage of a download or redirection chain. The presence of a 'download button' heuristic further supports the phishing lure attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=sas+zombie+assault+3+unblocked PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4475741/normal_5fe480f82ff0f.pdfIn PDF document text
    • https://cdn.sqhk.co/vekudaselux/iihghge/telemedicine_jobs_for_physicians.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/b04005c5-7d7a-41fb-9034-6e47c0f6cd8e/lanula.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/05d77c4f-e7b1-41ee-a21d-5767c27acd8a/wekagiruvumugekuko.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e98ff868-3af9-400f-a22a-02a5f44d1265/21530574921.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c07eb22-0bed-4800-b0b5-7f6a51969efb/.pdfIn PDF document text
    • https://s3.amazonaws.com/gezejoputiwinu/nsw_teachers_accreditation_maintenance_report.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0f0d97dc-d126-42de-983d-447c8d7dc505/relutoditowajetivovel.pdfIn PDF document text
    • https://s3.amazonaws.com/remufuzu/zujewuzem.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5df3f7db-9de4-42b6-b430-04138a14eddf/algebra_superior_schaum.pdfIn PDF document text
    • https://s3.amazonaws.com/dugibabafod/16418749531.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a224b35-50ae-4ad0-a5fd-99da40b419ed/87459475905.pdfIn PDF document text
    • https://s3.amazonaws.com/sezebepit/43102421233.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc8e4b6e-ec85-4587-b2ce-f2ba4038aa87/dragon_age_inquisition_cassandra_romance.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f6f87b5e-954c-4064-b138-fc25fac28c6b/55815066491.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c717.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC717 5512 bytes
SHA-256: de91a1d8097df6aeb36930bf9ef7f5860aaa311fa15a457814f9d3ca6b61aa95
font_01_sfnt_off0000d9c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD9C5 10156 bytes
SHA-256: 5fdd23293b9c014e6d4ceed2b5b32e3a24e67949114b8153dd3ba01ad2eaf5f8
font_02_sfnt_off0000fc30.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC30 18496 bytes
SHA-256: 01f199a4309a4efa1d0a972a7f4566f493b9ddb801b42fdd8ea0a41e4a18ac9b

Open this report in the interactive analyzer, or submit your own file for analysis.