Malicious PDF — malware analysis report

Static analysis result for SHA-256 57e654085e083475…

MALICIOUS

PDF

72.1 KB Created: 2020-12-10 14:03:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 7535f61ceebfc123cd208bb4539b182e SHA-1: 18cdc6b94a2c5b7ecfa174228e16e0962ab16756 SHA-256: 57e654085e083475300980b13ea046a88d97d55b093f987130fc95a4fec4b07f
234 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV. It contains a link to a known malicious redirector, 'https://traffine.ru/aws?utm_term=antivirus+for+windows+8.+1+free', and heuristics indicate it uses a 'Browser extension / update installation lure'. The document body also contains evidence of 'CmdRun.exe -DownloadFile', suggesting an attempt to download and execute further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/aws?utm_term=antivirus+for+windows+8.+1+free In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc4c575a5bc066edfbe6634/t/5fd1e3010f163860c7b14ef6/1607590658260/troll_face_quest_video_games_2_level_9.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5523bd26ff1194f913b76/t/5fd17eef1693665fc7c8e716/1607565040187/fudukezirabifosaniluvedo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc10c1368612547ed5ef44e/t/5fcc012f83d2ac65ccfe6ce4/1607205168904/best_modern_romance_books_of_all_time.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0ba3b0a2757459be1f9cb/t/5fc2a8ab2dd96f59184580c1/1606592684218/membrane_structure_pogil_answers.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fcebc33eb0bb74023f8d0ec/t/5fd0b99251357b44bb97e515/1607514515307/ninarotovixapuka.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc363b5c6d964583631f5aa/t/5fcf461355629615614e8827/1607419411859/ultimate_battle_games_epic_war_simulator_civil.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5957f084698658e7e225e/t/5fcd5adb1e1a4d7de13c2e9e/1607293659892/jadujomevurezexuwizoxu.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4fa93affbf90a6604a896/t/5fcef95afaf0bc04d1c0d887/1607399777978/3092446978.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6675ec14dfd36fe172514/t/5fcf172a05f6f27807526a08/1607407402793/mastercraft_2020_x24.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc013fe3398ff751529adbc/t/5fc2c59bf81c9a2a0cfdbad0/1606600092953/administrative_medical_assisting_workbook_answer_key.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc56ad7a87939686426701b/t/5fc7b5cd1d106d256bcc5b3c/1606923726494/merge_kingdom_apk_mod.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd0022cc750a3b5a06b04a/1606221859665/75943931650.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e2fd6b97992eb55c026f/t/5fc25cab9ee0f32b879f9dfd/1606573227210/20659692192.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc14640df132613bbc04837/t/5fc2cfe3f3de5e49b5c14eac/1606602726027/mekomokuxazigerelapilu.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4d75bbd14ff0dd2b5e666/t/5fcd79818a55f2188b8db6a7/1607301506041/20827173111.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5827fa879396864275a1a/t/5fd0891012264b5dfdce769c/1607502097139/descargar_crunchyroll_manga_premium_apk.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dd2b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD2B 5076 bytes
SHA-256: 9965e7bb2d53a228d741ccde9cc2a942ae89e9b9a7ea9b61d8fdd5ea5341e160
font_01_sfnt_off0000eead.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEAD 10916 bytes
SHA-256: c6770f95168cc9dfdbba36f35cf73317755d11b71b9a963e7a2d8261866558cb

Open this report in the interactive analyzer, or submit your own file for analysis.