Malicious PDF — malware analysis report

Static analysis result for SHA-256 35384a2cf8496265…

MALICIOUS

PDF

245.9 KB Created: 2020-12-30 13:20:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: febf924cda3fd17508f63e0a16c2d2d7 SHA-1: d337a1df35071e1e9a87a48cfe8de1fe1e33e6d2 SHA-256: 35384a2cf8496265af9bcb36349cbb8d7fbbd50e58151935c2ba80261af99cab
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV with a 'Pdf.Phishing.Trojan' signature. It contains an embedded URI pointing to 'trafftec.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to a 'Honeywell th5110d1006 manual'. No scripts were extracted, but the presence of external URLs and the phishing signature strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4345

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=honeywell+th5110d1006+manual+espa%25C3%25B1ol PDF link annotation
    • https://tebokefabizanil.weebly.com/uploads/1/3/4/8/134866802/2b121bc.pdfIn PDF document text
    • https://cdn.sqhk.co/zenetofuma/dzjeZyN/89577431204.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446490/normal_5fe1790c5b6c7.pdfIn PDF document text
    • https://cdn.sqhk.co/vopufepivipe/AiiWrhh/the_adventures_of_tintin_trailer_music.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://uploads.strikinglycdn.com/files/4bd82e1b-2e05-4324-9450-dbda43e9924b/merebuwumidapetusiditod.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb97e3c4-5776-411e-9ee9-8430052be934/wubawojeretasusagukas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2fc2f592-fb20-4df6-a1c1-04650d1e481a/63594523274.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/db623246-188b-4ba8-abd8-8cb7b676cb9a/absolute_monarchs_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f37494c-35d8-4711-9975-2a2768f62285/7682796738.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0002a0c9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2A0C9 54780 bytes
SHA-256: f41a36e6b0c3999a02ad8b9b303f4588b4d761a5d29c1d35162952359d198d84
font_01_sfnt_off000345eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x345EB 5944 bytes
SHA-256: 70b5c199a1274afe41e894d30f06d4ce530cea52ad15caef58a797cccadbe1ef
font_02_sfnt_off000359d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x359D4 2308 bytes
SHA-256: 6b1d796071cbc81b87025c01d9f367ef851780a49f35ca2399d83e4045dcf5bc
font_03_sfnt_off000363dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x363DD 13844 bytes
SHA-256: 195e921b0b5b6e7a75d3a184a9b3b4767b3966d4b0b087b4c8bcf3601056cac0
font_04_sfnt_off00038df4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38DF4 16276 bytes
SHA-256: 9eab19485fa6631919a5fce0e1b7f8f6c64e42a7561505de0b2f77f0efaadba7
font_05_sfnt_off0003a35a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A35A 2324 bytes
SHA-256: fa89a1600d13dd301f5fb0bcc0958607bbf24f5ab15449c47c0ef1b0b1221229
font_06_sfnt_off0003acf9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3ACF9 2112 bytes
SHA-256: 4906118a6e775b279944ba92789d3a2f669acb454cb8cb12d64243f54a8ca6fc
font_07_sfnt_off0003b5bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B5BC 6384 bytes
SHA-256: 82b028be66243d626cbdb732dc1075782b53576096c72094f00b91db4cc91c70

Open this report in the interactive analyzer, or submit your own file for analysis.