Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fe3bd2b0dc2fabd…

MALICIOUS

PDF

139.3 KB Created: 2020-12-20 19:55:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: dccc3c57c534ba156997b5e98a838980 SHA-1: fbf50463982a11312736100a30c451e689572372 SHA-256: 5fe3bd2b0dc2fabd4551d43ce449ae8eec88cc9b56d27e40ebcd603f0f2283b7
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL, https://trafficel.ru/aws?utm_term=age+of+empires+2++ios, which is presented in a context suggesting a lure for 'Age of Empires 2 iOS'. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs indicate a potential for malicious activity, likely phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=age+of+empires+2++ios PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/86a00a83-4b56-447a-8f2d-bdd2398fed14/50813761886.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf48cdf81c9a2a0c981030/1606371533603/hall_county_inmate_list.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc33129affbf90a66f953cc/t/5fc4f345173fb5383b3f2454/1606742853594/43619410930.pdfIn PDF document text
    • https://s3.amazonaws.com/fasudikek/28590935655.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1423a002-51a7-4e85-9434-da6028fca554/bizexixolizibogeji.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3c537c69-69d3-4fdd-b7c2-517681725ee5/97526304194.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d833accb-5a07-462e-98bd-ac85013e8113/13112766106.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc3bad5405d5340f33b4f5f/t/5fccfcfc0ab5d62febf4eee6/1607269638346/41339115315.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1b5e47d0c8f249d467b8d/t/5fc6fe08bfb90028be45edfd/1606876685012/tiny_battle_simulator.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a0cc4e6-ed91-4725-802b-8f00bc3bc73b/76468150600.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cff08164-9918-42dc-9651-5c5a4a6e6457/97595420950.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0ebe5f9866f3fd2d478df/t/5fc551114e98326c02c16c07/1606766866111/dotumet.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fdc7a3b0a190b16b315946c/t/5fdce045a61ece75b4cddcb0/1608310854484/adelantado_trilogy_book_two_full_version.pdfIn PDF document text
    • https://s3.amazonaws.com/kavugusepe/lorilidadonepujojuzi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b68bf26-ea6e-44ec-9509-4aad3dbfdf83/gaziberevofube.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off0001eb3c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1EB3C 28924 bytes
SHA-256: a427cf2896ebdfff00f7c9ba058e1c58583df0e058a85692082bd7ece00d1252
font_00_sfnt_off0001a8a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A8A5 5100 bytes
SHA-256: 6098bd79dda82f3ad0b68e195650745814076d6d9138484238b4e2c0807561ec
font_01_sfnt_off0001b9f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B9F3 1984 bytes
SHA-256: d975ee5ed68b3f456069e2400a3f3454167992d211219adf3a5ab92225d52a38
font_02_sfnt_off0001c366.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C366 11628 bytes
SHA-256: 6df9621f71512c4b23864545df79fe415ce6bb8037849d201ab244f9e11673fc

Open this report in the interactive analyzer, or submit your own file for analysis.