Malicious PDF — malware analysis report

Static analysis result for SHA-256 2aeb46d1c81cfe16…

MALICIOUS

PDF

75.4 KB Created: 2020-12-29 22:56:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: e67c0c341a367396c00f6e6f7d8b221f SHA-1: 0158d5412e6b07baf3142292e2c275cd92701d89 SHA-256: 2aeb46d1c81cfe16019035e3d843180604cb4c385b8415cc9a3815040dab98ed
104 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The presence of an external URI pointing to 'traffset.ru' suggests a redirection to a malicious site. Although the document body is heavily obfuscated, the heuristic 'SE_URGENCY_LURE' indicates the document likely uses deceptive language to prompt user interaction with the embedded link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=real+drum+games+app+skins PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4402504/normal_5fa284ec76127.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405409/normal_5fc202299470b.pdfIn PDF document text
    • https://cdn.sqhk.co/navififoro/R3koRNF/zexenokeluramisim.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xeroguru/pasuboserozivegaturisewow.pdfIn PDF document text
    • https://s3.amazonaws.com/guvovigo/15921964158.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5b4f163b-c071-4b29-a14b-7f97e3062889/bajobopep.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c099843a-7ac9-4c57-9302-23a7b0581e4f/lixulelefibutozep.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/965ab233-4cbe-4ff7-933b-a6b5d66f365d/calculating_dosages_safely_a_dimensi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/949a3fa6-f77f-4e82-9c3d-31ddf212ab29/fokoposakowikavan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5bbda49-fcd8-481c-9f9f-fbb4e971625f/wozufumusujujifokop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dab96dc7-fbbc-44ad-8857-dbbe4150a737/mifaxobowevasex.pdfIn PDF document text
    • https://s3.amazonaws.com/nowonovege/bioshock_3d_mobile.pdfIn PDF document text
    • https://s3.amazonaws.com/xefezesebusu/confidentiality_agreement_template_ireland.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/474f65d6-bad1-44a0-b854-35f76c746953/zazip.pdfIn PDF document text
    • https://s3.amazonaws.com/dobesogum/netflix_apk_android_tv.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e8bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE8BF 5348 bytes
SHA-256: bd8157305695975bf8ef5c878cc44d798dabb13b71ff552cbd2ab55b56973636
font_01_sfnt_off0000fae0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFAE0 11060 bytes
SHA-256: 81edab22142455aef48f476fa059dfe44e2fff094a2f0fe4db2cdc08e714ac2c

Open this report in the interactive analyzer, or submit your own file for analysis.