Malicious PDF — malware analysis report

Static analysis result for SHA-256 28e4db2d36a9231a…

MALICIOUS

PDF

201.1 KB Created: 2020-11-20 04:54:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 94f9ced3df05c6fbfa6fdc4d41e39046 SHA-1: 9132747e953217c0fab76784ac86c983f04ee35a SHA-256: 28e4db2d36a9231a683ef1733d37e9ee820c44432368a47eb262f55e786c7b18
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'traffset.ru' suggests the document is designed to redirect the user to a potentially harmful website. The heuristic 'SE_URGENCY_LURE' indicates the document uses deceptive language to prompt immediate user action, a common tactic in phishing attacks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7026

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=you+are+a+pirate+remix+roblox+id PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4385206/normal_5f994bf05abfd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495409/normal_5fac53e63e04c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426257/normal_5fa7fba0efa25.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384463/normal_5f8e38561badb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378149/normal_5f8abbc288dcf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4468836/normal_5fad695facf34.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382790/normal_5f8cf34194241.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4450628/normal_5fad86cc96ec1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421214/normal_5f9a8df7c38c0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486778/normal_5faa8a5d49962.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453129/normal_5fa34f5ed5e8f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gorajikunobixi/2952279724.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00025986.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25986 6676 bytes
SHA-256: c771749ac430df80d980b7b547ce8d3855b3538cef4b0649cf9476a0c216e958
font_01_sfnt_off00026a28.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26A28 7612 bytes
SHA-256: dc449ec4ce3728908ecb1434dbd88ecd2807fb54863fb6ba7ee8711c9ae0fa26
font_02_sfnt_off00028439.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28439 5096 bytes
SHA-256: 14454db7b303c0e70eec418cfeb226b1d2eda9cd71bc0ffe962ba1d0772e20ad
font_03_sfnt_off0002956b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2956B 9808 bytes
SHA-256: 6e84653bb3e4644513a9c83c944532e3073909bb690229732a4837f06d8dc0d1
font_04_sfnt_off0002b62d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B62D 15520 bytes
SHA-256: 62312e2f65f915ee2d59aff75eb4be7facd364a43cab61e886312a0c76d8ad78
font_05_sfnt_off0002e871.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E871 18820 bytes
SHA-256: b99edcc9c420a1608482524fab82523cebfc0ba2d5487ec45fb90039f89d03de
font_06_sfnt_off00030583.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30583 6092 bytes
SHA-256: 199de17b37d980607652dc3a581408f9830330031120ba242c89a21cc59fa666

Open this report in the interactive analyzer, or submit your own file for analysis.