Malicious PDF — malware analysis report

Static analysis result for SHA-256 6fe69a21abca593d…

MALICIOUS

PDF

86.1 KB Created: 2020-12-20 18:31:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 7410f1727e7265be2222d9de5abf615d SHA-1: 13453c89cfbe524e8313e98865f96e8ac7b65585 SHA-256: 6fe69a21abca593df65c981d9987e6a2ca694b494c99b37636bd1cf8355395b6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL. ClamAV and ML classifiers have flagged this PDF as malicious, specifically as a phishing trojan. The embedded URL, https://trafficel.ru/strik?utm_term=rod+moment+of+inertia+perpendicular, is the primary indicator of malicious intent, likely leading to a phishing page or malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/strik?utm_term=rod+moment+of+inertia+perpendicular PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4418584/normal_5fa1e535625d3.pdfIn PDF document text
    • https://lixaworone.weebly.com/uploads/1/3/1/8/131871871/losimavuteza_fobuzalejaken_guvijanadude.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4377377/normal_5fceff74b51e7.pdfIn PDF document text
    • https://tatogupuragafa.weebly.com/uploads/1/3/4/0/134096405/5247690.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e42ddb0-76d5-4a7f-b98b-8df45c09ce7c/4586782671.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6445fa3bf4b14abcdaac2/t/5fcee18168c18617d402f2d7/1607393670526/polaris_indy_adventure_137_patriot_850.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0ec6c8787e879896c16ae/t/5fc22c9d173fb5383beb95c5/1606560925713/55381970576.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c38c292f-3244-478c-9e2b-7aa60f46d632/how_to_make_a_car_roblox_2020.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6db42504bb4653ce19d0c/t/5fc809d48f408a487d15cce1/1606945236817/basketball_local_arcade_game_uk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/282e75aa-e362-456a-83b5-7f2d965c1f59/gupijejifop.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc64b09f7cf8c75404f74c5/t/5fd70df0ab1a676c72a58875/1607929329146/outlook_open_template_from_ribbon.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8155d3c6-e7cd-4e36-aac1-647da6989c88/a_scanner_darkly_download.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc32e547848ba205d276709/t/5fc6bc8eb7521d608a2d3537/1606859925569/zomusepimup.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d18f5fd5-5ea1-4999-9cff-aae9362e8d61/kirozopikepezoj.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc578bb92c50b1a1e9652c3/t/5fc68eb64f98375720c40022/1606848183065/the_king_of_fighters_street_fighter.pdfIn PDF document text
    • https://s3.amazonaws.com/kofabube/sight_word_with_video.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD9F 5132 bytes
SHA-256: efb2bd5be6fd29efcfb78238c259aec49811c882c6db20d2c5d856bca5b4a764
font_01_sfnt_off00010f00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F00 11292 bytes
SHA-256: 29fb2745ee1d6191b810e9f7561baea5547d59d614c472bdc7cab04ccc549dae
font_02_sfnt_off0001361e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1361E 16096 bytes
SHA-256: 3a87a2a80cb0740ff7ad33dbd9b35031d90241dfccc5ab96a3d2c3133af9c3ca

Open this report in the interactive analyzer, or submit your own file for analysis.