Malicious PDF — malware analysis report

Static analysis result for SHA-256 258f002fd8ef4a84…

MALICIOUS

PDF

73.4 KB Created: 2021-01-10 08:35:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 67a819794328fdcee1e7533dc271a55a SHA-1: 1a83339f60fc3cb64d632ad26315c0bcc72596d8 SHA-256: 258f002fd8ef4a843d92c6ff94f22cd54dc57264c30ff2a96aaafd88a70a7c7e
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by multiple heuristics, including ML classification and ClamAV detection. It contains an embedded URI pointing to 'traffset.ru', which is a strong indicator of malicious intent. The presence of a QR code lure suggests a phishing attempt, aiming to redirect users to the malicious URL via a mobile device.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=fort+zumwalt+west+school+district+calendar
    • https://cdn-cms.f-static.net/uploads/4409236/normal_5fdc3b0dadba1.pdf
    • https://cdn-cms.f-static.net/uploads/4376609/normal_5f9816277bd98.pdf
    • https://cdn-cms.f-static.net/uploads/4369923/normal_5f934cbccf136.pdf
    • https://cdn-cms.f-static.net/uploads/4378836/normal_5f907c8e63ae7.pdf
    • https://cdn-cms.f-static.net/uploads/4454170/normal_5fa0ce920fde1.pdf
    • https://site-1175933.mozfiles.com/files/1175933/nufogijuxeladub.pdf
    • https://cdn-cms.f-static.net/uploads/4366325/normal_5fba955452b44.pdf
    • https://cdn.sqhk.co/jerizukop/ibgcihh/81111356310.pdf
    • https://cdn-cms.f-static.net/uploads/4384640/normal_5f9261898007c.pdf
    • https://cdn-cms.f-static.net/uploads/4475866/normal_5fdad1c41807c.pdf
    • https://cdn.sqhk.co/tupipitijil/Fhciajh/79613678938.pdf
    • https://site-1172264.mozfiles.com/files/1172264/tuvunab.pdf
    • https://site-1188839.mozfiles.com/files/1188839/kabosav.pdf
    • https://cdn-cms.f-static.net/uploads/4366309/normal_5f88fbc5da04b.pdf
    • https://fzwestactivities.bigteams.com
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3f7.bin
b4645d582eddd13b6514c7f29e3df506ca2ae65e1cfc6afa26fc193720c94a7c
pdf-font-stream PDF embedded font (sfnt) at offset 0xD3F7 5156 bytes
font_01_sfnt_off0000e571.bin
b07b8108e261346ac5555d38a1e667fa81d2379dab90a11cd7700de9f82a2418
pdf-font-stream PDF embedded font (sfnt) at offset 0xE571 10840 bytes
font_02_sfnt_off000109f8.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e
pdf-font-stream PDF embedded font (sfnt) at offset 0x109F8 4324 bytes