Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c3d8ab16d71ffdc…

MALICIOUS

PDF

71.4 KB Created: 2020-12-02 19:32:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 1136395123a426c7a066f17af3c67304 SHA-1: 14e6f748dab22fa0bb6fff61ea921d9a7b29d2d2 SHA-256: 7c3d8ab16d71ffdc195f1a08486b7438f250861421b1d83cb74520fd9d3dbeb5
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The 'PDF_SEO_UTM_REDIRECTOR_LINK' heuristic specifically points to an image lure leading to a redirector URL, suggesting a phishing or malware distribution scheme. The embedded URL 'https://trafftec.ru/aws?utm_term=tamil+christian+video+songs+hd+free' is the primary indicator of this malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?utm_term=tamil+christian+video+songs+hd+free PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4369508/normal_5f893b8ddfee9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408706/normal_5fb45bfce7590.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416810/normal_5f96f896b1379.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445866/normal_5fc66b1317e57.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4460725/normal_5fa1f4b1402e2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/bejikefowu/soxijadupaze.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc14f4aa13a450babf6e3a6/t/5fc3f2f53c6ccf69f3d8cfcd/1606677238620/nakorawibofefexagonezapig.pdfIn PDF document text
    • https://s3.amazonaws.com/tamobalasu/minecraft_enchanter_ftb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1cc5476a-30af-495a-9da2-ffedbe0b1940/vagutukadirimilopo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe05994e98326c02d6ea6f/1606288800244/skyrim_hired_thugs_mod.pdfIn PDF document text
    • https://s3.amazonaws.com/piwanisaj/jefon.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2de6511f6a41984928cab/t/5fc7c4780623334b0c6d90c3/1606927488679/entrepreneurship_development_notes_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c7b5638-3d59-43d9-9f2e-32668d5af7b8/find_slope_from_two_points_worksheet.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbfdb415687f52b6b7b2913/t/5fc29d80eaf37e3b64f20be6/1606589825299/latex_table_environment.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe02caf3de5e49b52abfeb/1606288076041/one_page_strategy.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dae2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAE2 5444 bytes
SHA-256: 7b3aabddd2497fdd911de7887c4b1a71cb6b0d4e5ce9551afd56e66071a1e339
font_01_sfnt_off0000ed3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED3F 10400 bytes
SHA-256: 1924f6c0bfe075919dcc421644b87dd3a415281d7dba4474cf99a3568fbb62d9

Open this report in the interactive analyzer, or submit your own file for analysis.