Malicious PDF — malware analysis report

Static analysis result for SHA-256 3fa92f86d5db8bbc…

MALICIOUS

PDF

63.8 KB Created: 2020-12-06 11:41:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: e448e078276546e8b5cb4522ec50420b SHA-1: 16db2f135c1762db3785e168cc4d0a8ef8d42658 SHA-256: 3fa92f86d5db8bbc0fcb121bb4941548fc6e3e11a60f16d4c440f06bb36778c3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URL pointing to 'trafficel.ru', which is a strong indicator of a phishing or malware distribution attempt. The PDF structure itself does not contain executable scripts, but the presence of the external URL is the primary threat vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/strik?utm_term=the+giver+metaphors PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4494429/normal_5fb2c7c654324.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377697/normal_5fb4d8b449a49.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375204/normal_5f8de93c5cd53.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4479254/normal_5fc8741fd0250.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406785/normal_5f9f10b4733a0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379038/normal_5fa1cf2238635.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/c5480731-fb0f-4923-9753-fc8af397628d/option_youboox_one_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f343a4d-ddab-4c0e-a08f-cdf7b1a99bf6/23933993677.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a78e8f3-219b-4dff-b150-24980aba5f4b/licking_county_sheriff_inmate_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e6843bc-2899-4def-b585-2b91238e1e77/available_siberian_kittens_australia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81b86bb5-c0f6-473b-95ec-de7874920dd3/kwikset_909_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ced7873a-4d1a-4256-a1cc-f450a3b49add/earn_to_die_2012_part_2_hacked_unblocked_at_school.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a951be2-f050-4e55-80a5-54bbbe4cdcfa/61624222214.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19adeb68-c5ea-4fd0-9456-8038e24875a1/39389468212.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bf74.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBF74 5212 bytes
SHA-256: 9358ea5dd8713e011c024072ffe2d484c7d2dbd97c3ca49417922430c9411c35
font_01_sfnt_off0000d10b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD10B 9932 bytes
SHA-256: 7c9d5fd93578f03462c973cfceb2d288761981d613296ad9b42fa4ac7fd4eca7

Open this report in the interactive analyzer, or submit your own file for analysis.