Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d2eba3f83745dc2…

MALICIOUS

PDF

91.3 KB Created: 2020-12-26 20:48:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 798628c859e5fedd2882404dc68e5727 SHA-1: df58141595165957f0f6fb6f5100811b9cbf59fb SHA-256: 6d2eba3f83745dc22ebf99f7ac0b7314bbda79f8cfeaa3fcc3bd8d646bc8b9b4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF with a high ML classification and ClamAV detection, indicating malicious intent. It contains an embedded URL pointing to 'traffset.ru', which is likely used to deliver a malicious payload or redirect to a phishing site. The document body is heavily obfuscated, suggesting an attempt to hide its true purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=drift+trike+sleeves+hdpe
    • https://static.s123-cdn-static.com/uploads/4530578/normal_5fcf3383213f5.pdf
    • https://static.s123-cdn-static.com/uploads/4366340/normal_5fe41ba752ff6.pdf
    • https://cdn-cms.f-static.net/uploads/4412763/normal_5fc0912f5f8a4.pdf
    • https://static.s123-cdn-static.com/uploads/4425768/normal_5fcef6bbddf72.pdf
    • https://static.s123-cdn-static.com/uploads/4386836/normal_5fc7e15ee4989.pdf
    • https://cdn.sqhk.co/kipebakebe/heoPfia/costumes_near_me_halloween.pdf
    • https://static.s123-cdn-static.com/uploads/4418379/normal_5fc9faa738c0d.pdf
    • https://cdn.sqhk.co/dunokufimove/iijdjdA/44158781208.pdf
    • https://cdn-cms.f-static.net/uploads/4485329/normal_5fb4ff0f1deb6.pdf
    • https:///\/a10.gaanacdn.com\/images\/album\/86\/2773586\/crop_175x175_1566279476_2773586.jpg,albumartwork_large:https:\/\/a
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://uploads.strikinglycdn.com/files/a390c7c0-007f-4dc4-9c37-0e445f38ad53/mantos_e_palmas_espalhando_vai.pdf
    • https://uploads.strikinglycdn.com/files/8d783cac-337a-49cb-89b0-58b6673e05b4/ribagefozamaxokajato.pdf
    • https://uploads.strikinglycdn.com/files/8fcc47fe-873c-46d1-99cd-884ab4c66a8a/32987276921.pdf
    • https://uploads.strikinglycdn.com/files/82fa2b15-6fa5-4318-889f-3ad0eebb9669/analisis_de_foda.pdf
    • https://uploads.strikinglycdn.com/files/8516b1c4-4abf-4e51-b4a8-0bf71c968811/18994524164.pdf
    • https://uploads.strikinglycdn.com/files/04a4704a-b7e3-4fcb-bab2-37d13ef5bf33/67492384996.pdf
    • https://uploads.strikinglycdn.com/files/31eabfad-9cde-4a28-8834-95d649ec195f/31482734767.pdf
    • https://uploads.strikinglycdn.com/files/f48a33ed-a4af-4beb-9723-e8c6be914f46/ryobi_2800_psi_pressure_washer_parts_list.pdf
    • https://uploads.strikinglycdn.com/files/4dd6bbb7-36d0-4def-8270-014d82e92b11/estimating_answers_by_rounding.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://sinhala.sourceforge.net/
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITS
    • http://www.gnu.org/licenses/gpl-2.0.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db7a.bin
7ece2870fe3fdc53432270c39b3a99cfb8acb0ae49e5908ee4b3a8e56129dfc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDB7A 5040 bytes
font_01_sfnt_off0000ecab.bin
04b6156129c2a6e1cb4c5edc51dc6b76be4baf2dca460daa9ba69311610bf071		 pdf-font-stream PDF embedded font (sfnt) at offset 0xECAB 3000 bytes
font_02_sfnt_off0000f8b4.bin
8b4115a7dc552d27182f40091a760e60dfe37c10aac945d30a692cbcd4a76144		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8B4 4144 bytes
font_03_sfnt_off000107b7.bin
74684692b877bb9e2c4e625135887e01058036562552cdc3d8170c6cf0e3f3f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107B7 6756 bytes
font_04_sfnt_off00011e1d.bin
5d5464defce1a30f7ba0fbbd1e02a8b41baaaecde9373ae6af268b3177dcca4c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E1D 11384 bytes
font_05_sfnt_off000144af.bin
c10f60178bc77dc7b45349e936658b1140187ee912781611996fedf31a74824f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x144AF 17512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.