Malicious PDF — malware analysis report

Static analysis result for SHA-256 4dc1bc7f9b8a1345…

MALICIOUS

PDF

87.5 KB Created: 2021-01-16 10:19:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 652cd87db460cfa3ee164e6eb45570e1 SHA-1: 3fdd1ea8467c9d8073f9c3145d00eae9df58b38f SHA-256: 4dc1bc7f9b8a1345865cd24bcb4f7951f29e3864def729fd38cdc5aabe296b68
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'trafftec.ru', which is likely a malicious domain used for phishing or to host further malicious content. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a harmful external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=fossil+fighters+champions+wiki PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4423148/normal_5ffb80c008bc4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456984/normal_5fbd6d236709f.pdfIn PDF document text
    • https://cdn.sqhk.co/gogojiranat/PehaWja/game_called_among_us_age_rating.pdfIn PDF document text
    • https://cdn.sqhk.co/divojimo/whchhfT/sozusikoxirozu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366043/normal_5fbc7f820961f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373997/normal_5f93c96631ea5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4409425/normal_5fa08dc75b116.pdfIn PDF document text
    • https://cdn.sqhk.co/dorusafe/hXjdMeN/60609647044.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408993/normal_5fb3df8ecf1d5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387577/normal_5f9f6668962b5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/regufojalojaza/chemistry_textbook_for_senior_secondary_school.pdfIn PDF document text
    • https://s3.amazonaws.com/wizidimawag/godizikazopanawuwe.pdfIn PDF document text
    • https://s3.amazonaws.com/tokafanawa/wibibamomobajivewogudike.pdfIn PDF document text
    • https://s3.amazonaws.com/midizaxopazeji/74203074685.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000106f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x106F6 5028 bytes
SHA-256: 6a0695386c5140d155aa9524073277807ef9899024cdf2b65084ff681b822b1e
font_01_sfnt_off00011873.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11873 5540 bytes
SHA-256: 6c25c14237b68373ea718a53dd24a90fcfeef1bd50b2e8db53ae5ae1e691711d
font_02_sfnt_off00012b3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12B3D 11016 bytes
SHA-256: 3fd45115e431f3d6dd79477e1196278bb21eff765b94604e4fac3f441080646a

Open this report in the interactive analyzer, or submit your own file for analysis.