Malicious PDF — malware analysis report

Static analysis result for SHA-256 368c7379e49dc38a…

MALICIOUS

PDF

103.5 KB Created: 2021-01-26 11:38:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 343382be01e1e644bc7b0d3dacc7be4c SHA-1: b38bb957b7c0ac7da18545972a2f91d1d611d5c5 SHA-256: 368c7379e49dc38ace66a41d6f90c822f3bae835d902168948eddcb3ad70e984
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to 'traffset.ru', a domain commonly associated with malicious redirects and phishing campaigns. ClamAV detection as 'Pdf.Phishing.Trojan' and ML classification further support its malicious nature. While no scripts were explicitly extracted, the presence of external URIs and the overall classification indicate an attempt to lead the user to a malicious resource, likely for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=btd6+chimps+guide+cubism PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4369334/normal_5fc7ecaba2f33.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4385030/normal_5fef46161babf.pdfIn PDF document text
    • http://vas-rem.ru/wuxaxee2ct7.pdfIn PDF document text
    • http://bigtittybella.com/laminazud3or32.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4455377/normal_5fdfcbde0e9dd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4393220/normal_600747a165202.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4389384/normal_5feb05977a398.pdfIn PDF document text
    • http://buyfastedcircle.xyz/k2_shadow_skatesvq42v.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487208/normal_6008ce939795d.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4389354/normal_5fee0e65620ac.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4411709/normal_60012f7572463.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4415527/normal_5fc7dea4c86a4.pdfIn PDF document text
    • http://sale20.site/dogituxofepijd82f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449614/normal_5fd66735b2200.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4423752/normal_6002fef224149.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4482645/normal_5ff68baa75a64.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://bawozejowavonot.rf.gd/collaboration_with_google_sheets.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000136b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x136B6 9804 bytes
SHA-256: 9a47dfa05a20ebd2e8f05dd24d5e8ce25bf37214570e8110e33abfa5b1586ce4
font_01_sfnt_off00015773.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15773 5492 bytes
SHA-256: 817a5b5fb99d46da7aa8f44226134645b1fd33022e8e98f0a707e60391ccda18
font_02_sfnt_off000169fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x169FE 11176 bytes
SHA-256: 730953a4a63bc438235b735a6a3a994025f84cccbf242c982207a58e9027bfe2

Open this report in the interactive analyzer, or submit your own file for analysis.