Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b5655fd6c1ce078…

MALICIOUS

PDF

71.9 KB Created: 2020-12-24 15:01:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: f75c3ff48e74f5fcb16d745f39c93e4e SHA-1: 6da148ec04a5e299b3543256971ec4bc3ff89097 SHA-256: 7b5655fd6c1ce07859d93c2b4b3cfcbd89421213a859358ea5bdc895962e3032
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The embedded URL points to a suspicious domain, likely used to host or redirect to a malicious payload. The document body, though heavily obfuscated, contains text that appears to be a lure related to news and videos.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/aws?utm_term=dd+bangla+news+song+video PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4416786/normal_5f998b8abac46.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366969/normal_5fbedfba2cc8b.pdfIn PDF document text
    • https://cdn.sqhk.co/dowufagit/bhijfFR/einstein_s_riddle_logic_puzzles.pdfIn PDF document text
    • https://cdn.sqhk.co/lewivapawo/eKljg6Z/67572100886.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367294/normal_5fdd82b6a4fe4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4404524/normal_5fe41ace9ea55.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387060/normal_5fd6c9b65b94d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/41049c46-4d5f-4eed-8333-35fe69991d5c/gebenovewogef.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/950ba1b2-cdd9-4436-b5e9-76835ecbb59e/33792102549.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5083e342-4b6c-47d2-b86f-be9b2b3f5df9/31394485224.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66ba7fc2-3c4c-4c80-832b-70f8836d88bd/70289341797.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/695f941a-d909-44da-9797-82488ab374e0/62405537701.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e5b2aca-427b-45e4-a833-2ad8737f503d/ampeg_v4b_head.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/10647a44-b754-413f-803c-bfebe17c2f90/find_oath_ticket_finder.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f93b91db-2a5c-4882-a09b-21517b47f877/lost_ways_.net.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db40.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB40 5188 bytes
SHA-256: 857a8991e689e0516de02310c9801b0fdcef3c67d117277ae4524d074c8532b3
font_01_sfnt_off0000ed14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED14 10996 bytes
SHA-256: 7919d8141c996a4ec0deac29501b9db4e6899104cde93d2e49fc34548d434652

Open this report in the interactive analyzer, or submit your own file for analysis.