Malicious PDF — malware analysis report

Static analysis result for SHA-256 78e2aedd6a887297…

MALICIOUS

PDF

69.9 KB Created: 2020-12-15 12:55:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: ad351cdf8e4f0aecdadc10bbe890c9ef SHA-1: 1b44fa6427c841b4ba7abbccc71294b04f200af6 SHA-256: 78e2aedd6a8872972115eecd4279266b257c81979eebabf60dc1c62a965a8a02
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to 'traffset.ru', which is likely a malicious domain used for phishing or distributing further payloads. The PDF structure and embedded content suggest an attempt to trick the user into clicking the link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=head+first+javascript+programming+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4402949/normal_5fa15acfbb98c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc7aeac02915d4a16fa01ec/t/5fd0a74551357b44bb95f581/1607509829736/movies_coming_out_in_nov_2020.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd27a6d0116d4966acbb2e/1606231977142/hack_hill_climb_racing_2_windows.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8691015c-c9a3-43d3-b819-7ade62168440/surya_kriya_guide.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0dd745bcb0228a2824d01/t/5fc13b629ee0f32b877f9732/1606499177450/duniwatipoxevi.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fcea60c723a5f1b2ca2e406/t/5fd6a2c07fc52c20692ed6eb/1607901889790/fudinirapix.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/50d1d48e-91f7-427f-9e79-3412d372408d/73745076095.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/998e7bd5-388f-4dc5-80ed-a785967ee78c/94248766822.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/87aa35e9-a79c-4845-ae02-fee49f4aa5f5/how_to_clean_keurig_k_compact_k35.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6497fc14dfd36fe162dc2/t/5fc6aeb59b1ed03538caee86/1606856373642/buffet_items_meaning.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0aa5350c-3aa8-4ef7-9b83-71741484c8ad/bironozosu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abeafc43-501d-48e3-9d0a-b60e87fad2dd/is_resin_toxic_to_skin.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3F0 5540 bytes
SHA-256: 6b6e8751fbdbe7644754afd6ece222a31f4f40784d95a55bd4d3f05808561542
font_01_sfnt_off0000e6c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE6C7 10720 bytes
SHA-256: a5b5810ca512be11d36b3afb8397e280d6a05a38be7cf08a6427218f0bdd00e6

Open this report in the interactive analyzer, or submit your own file for analysis.