Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a1ebc2430150212…

MALICIOUS

PDF

75.3 KB Created: 2020-12-28 03:40:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 2eb670caf29132bd2c68fd415470992b SHA-1: 9ddb617d774f0338171dc18324f3f74c05199173 SHA-256: 2a1ebc24301502120d8bbda123d57a7500927a6ce0ae7da566c4c2a519f47fc2
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating it's a phishing trojan. It contains an embedded URI pointing to a suspicious domain, traffking.ru, which is likely the primary lure. Although no scripts were explicitly extracted, the PDF format and the presence of embedded URIs suggest a common attack pattern for delivering malicious content or redirecting users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=clinical+pharmacology+made+incredibly+easy+pdf PDF link annotation
    • https://cdn.sqhk.co/lojeliju/jgeQEgg/nintendo_switch_target_market.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/37095ae1-d627-46be-bf2a-51da2beeaf22/jabemivagofe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2120866d-230d-4e9e-bf8e-0c1ad529be91/218788560.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df3d9cf1-7ecb-43ec-90c9-d06059813009/kovilujowulukixusojaj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f338d25b-1685-411c-8825-d2903c3ee40b/how_to_lock_a_chest_in_minecraft_1.15.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7ba66d2d-e2d8-46f8-935f-3ddde3203d40/popukararulagidobaloj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8123ede5-29da-4ff8-8f8b-3ca510c5fa57/springdale_school_district_arkansas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b1d54e2-760a-4d08-9556-4699c0ab311d/21300318223.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f3af8e2-3712-41e4-b67f-239c230bac3c/gozojiridorexawazu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2ed4fe46-6825-4205-83de-69bc851b7540/csi_algebra_solving_equations.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e19d2355-2fe8-43f6-83a1-89b0093ba69d/1_estela_corrida_flagler_playa_fl.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c3ac536-59a1-488b-be36-8d54d51cc876/sorry_we_missed_you_letter_usps.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d90a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD90A 5544 bytes
SHA-256: 6062ba764646acb58db394b85ac8be9ac121c3d90283e565279aedfdb2e27aa7
font_01_sfnt_off0000eba2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBA2 11360 bytes
SHA-256: 737001a324cc898859552fe46f0bbf3377c15e5f9d345df6bc6e0727f532afd0
font_02_sfnt_off000111dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111DC 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.