Malicious PDF — malware analysis report

Static analysis result for SHA-256 7187c6ada997fae3…

MALICIOUS

PDF

72.2 KB Created: 2020-12-03 17:25:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: d3795c041571304f4aa3effab51a7cef SHA-1: d7058ebdb78690daf11b5483ecabbd413c8e9732 SHA-256: 7187c6ada997fae3bffd5927aa694565766e5a425048f93fa539fbc7d0fdfd90
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is malicious and a phishing attempt. The embedded URL 'https://trafffi.ru/strik?utm_term=wiimote+controller+apk+android+5.0' is the primary indicator of a phishing lure, likely leading to a malicious download or further exploitation. While no scripts were explicitly extracted, the PDF structure and ML classification strongly suggest malicious intent, aligning with a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/strik?utm_term=wiimote+controller+apk+android+5.0 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4391009/normal_5f8ddd43713ef.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447436/normal_5fbd05466b0ec.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368225/normal_5f99b1f23adf8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447098/normal_5fbe0b32877e5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4462352/normal_5fc0301a06dbb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc2fb60c30a162e0c601609/t/5fc49e423c02f22b9d9fdb13/1606721090626/which_liquid_is_a_good_conductor_of_heat.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5d30b7848ba205d3a93a9/t/5fc6e5954f9413233b11ec30/1606870421914/54188624600.pdfIn PDF document text
    • https://s3.amazonaws.com/rezugekolaba/bitlife_mod_apk_1.27.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9acb3a08-221c-4744-99c7-88b0d87be067/uan_parmaklar_hz_testi.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4bfa2bd14ff0dd2b5522a/t/5fc76cf09dfc2a40452000ff/1606905073341/hempfield_umc_staff.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc304a32e34347c70520823/t/5fc85c0f970db930d9be9459/1606966288010/bisosabibomijifalara.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5baadf7cf8c75404bcdf6/t/5fc8f13f046ad605778a9edc/1607004482137/the_difference_between_aware_and_mancala.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d78c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD78C 5416 bytes
SHA-256: 5d29857e1bb846f7723eef93e3e3a9c437c51da6ddbb5a2b90f4749023425be7
font_01_sfnt_off0000e9f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE9F5 11948 bytes
SHA-256: 8fab3c8f5cee22a41839461af8fcd58acbf0547c76e98bc22fb5e09dfb169098

Open this report in the interactive analyzer, or submit your own file for analysis.