Malicious PDF — malware analysis report

Static analysis result for SHA-256 70eca7c8312d63ba…

MALICIOUS

PDF

77.4 KB Created: 2021-01-05 15:56:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 022d04af92767551b665071328f08837 SHA-1: 80da665474246a179a139085879a61aebf92b439 SHA-256: 70eca7c8312d63ba16b6d10ed09a4cfbb0b9c38130c764afd0fbc8d8324452cb
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to 'traffnew.ru', which is likely used for phishing or to download a secondary payload. The PDF structure itself appears to be intentionally malformed, indicated by the 'PDF_DUPLICATE_OBJ_BODY_INCREMENTAL' heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?utm_term=gbf+light+grid PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4384652/normal_5fa071a7eeeb2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412379/normal_5f9fbedcbd911.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4468828/normal_5fdd39295ec30.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pulujolatepuv/jinudazaxogamimunogawomav.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c616768b-4af7-48db-b65f-9b1b07e4dcd6/9372341928.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e5e29582-a47e-4364-bb43-49256d231055/pumalexinajazumodoparo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dea33c6e-0bed-4f62-b1d5-6fac8fc47115/19649313923.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/75e78f8f-5e07-47dd-a61a-662659b7a42d/los_vendidos_theme.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a106633-09bc-42ed-a4aa-b29b8e6ef5fc/meatmen_comics_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c52a6f2-8e8f-4a3c-94ad-7374d068f376/pememijutabuziferope.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9b4827d9-938b-44a2-a790-898283da6da3/jizevekasopi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/68471c28-f344-4b24-8b8f-da5632aa1f96/grizzleheim_quest_tree.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eefd1560-2187-4956-8a83-29c89347a65c/34341349334.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1336393-d722-4903-bb08-664363633c36/90441040598.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f322.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF322 4952 bytes
SHA-256: 83d6f1a4923c9c98dad19683584dc35786110f6ade14a3b7c739a3c2cf14584b
font_01_sfnt_off000103f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x103F3 10760 bytes
SHA-256: 62d8ef005a0814e9dfa560ffa1adf1f066f90c69e186bfff5d8b3f70e4d288ed

Open this report in the interactive analyzer, or submit your own file for analysis.