Malicious PDF — malware analysis report

Static analysis result for SHA-256 4209071f3a4a60a9…

MALICIOUS

PDF

65.2 KB Created: 2020-12-16 12:39:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: bf9c7d217f59b3558606c3022e3814ed SHA-1: d28956ef5619c3bce55541982ae0a6b0815f6d91 SHA-256: 4209071f3a4a60a9f2cf99b4d849451799b21f295130fc14a765106295cfb90d
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URL pointing to 'trafficel.ru', which is associated with a school supply list lure. The heuristic 'SE_LOLBIN_RUN_COMMAND' also references 'scurlock_elementary_school_supply_list.pdf', further supporting the lure. The PDF structure and embedded content suggest it's designed to trick users into visiting the malicious URL, potentially for phishing or to download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/123?utm_term=multivariable+calculus+10e+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4489975/normal_5fb9e2eaac656.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382958/normal_5f933ab21fa66.pdfIn PDF document text
    • https://dogirewepa.weebly.com/uploads/1/3/1/8/131856222/pusezefolaju_pakexige_nituridu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419642/normal_5fca30e9c4733.pdfIn PDF document text
    • https://gawakugoful.weebly.com/uploads/1/3/4/7/134757428/xuridizezofozoje.pdfIn PDF document text
    • https://static.s12In macro / runtime command snippet
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/25121dc1-2424-48a5-a725-136dcb359e7a/9462246821.pdfIn PDF document text
    • https://s3.amazonaws.com/nedijowewoded/60015101711.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88fbd6e4-450f-4035-b157-eeb2e1cdcbc5/smartparts_digital_picture_frame_7_inch.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0f8effcf-786d-40bb-93e1-0ef5cc18fb61/powawulilokom.pdfIn PDF document text
    • https://s3.amazonaws.com/jidosatikim/free_birthday_party_invitation_templates_for_publisher.pdfIn PDF document text
    • https://s3.amazonaws.com/fonibinaraj/scurlock_elementary_school_supply_list.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b546.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB546 5212 bytes
SHA-256: a99eec535c325705f97dfd42b53fec173ae8a57b7c9e12a18d3f204b300da369
font_01_sfnt_off0000c722.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC722 10360 bytes
SHA-256: df54e596a48f38ce2a0594dddb17d64b778eff23bf874036f92216c7eb228c1a
font_02_sfnt_off0000ea0a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA0A 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.