Malicious PDF — malware analysis report

Static analysis result for SHA-256 7db524902dfd9f6f…

MALICIOUS

PDF

90.6 KB Created: 2020-12-16 04:15:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 855816d66e61a3dda18bf1c6a9aab340 SHA-1: 22ea1e9b90a2f2fc6bc98fdf1a88e26c613070a3 SHA-256: 7db524902dfd9f6fe6f76a93ba7efb7bc5f3b4d90a9dcc4ef34410c5f35d99ba
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that mimics a download link for 'Tor browser portable zip download'. This URL, 'https://trafftec.ru/strik?utm_term=tor+browser+portable+zip+download', is highly suspicious and likely leads to a malicious payload. The ML classifier and ClamAV detection strongly indicate malicious intent, consistent with a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/strik?utm_term=tor+browser+portable+zip+download PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4413475/normal_5fb4bb86dc2ad.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414851/normal_5f97444c1a3ea.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4480383/normal_5fbcec821819e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368218/normal_5fa2ea8dbda32.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369629/normal_5f8915dac51b0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static1.squarespace.com/static/5fc2830cc30a162e0c5caa26/t/5fc7047256cd4459b3ade973/1606878322611/8525381259.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6d88a504bb4653ce18603/t/5fd18313fec2791e31fee6c4/1607566100842/disable_digital_wellbeing_samsung_s9.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38eb0310-1612-4bcf-8d81-a6983f8a6142/rimitovurubusibipawewa.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc112c117e7202640eb3140/t/5fc6c4adc953717e09c28ff6/1606861997878/marshawn_lynch_commercial_night_before.pdfIn PDF document text
    • https://s3.amazonaws.com/degagaziv/rotagipu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/458d7537-7a71-4e0b-be36-a7c774884141/brillion_cultipacker_seeder_for_sale.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e01f2cf09257bd6be9c2/t/5fc346249ee0f32b87bce71f/1606632996693/76671488025.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0f8872cf09257bd6c6ae2/t/5fc1333208845d0924b5f1ca/1606497075148/best_cat_food_for_sensitive_stomachs_uk.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc58624bd14ff0dd2bbf2b9/t/5fc6569e3c6ccf69f33710b9/1606833823177/custom_ice_cream_cakes_near_me.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5126227a199023ad04ca4/t/5fcd45557ae85b53b29f5ccf/1607288149816/69244396002.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d733.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD733 4972 bytes
SHA-256: 375cd0e61243c6b5bce171debb9ccfdff2f49b53db4a1e4a1a34e25ec1f0a203
font_01_sfnt_off0000e829.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE829 11948 bytes
SHA-256: add28f36037558b347a6ddb9a6222ce2507b79a68118f295f17e9b38bcd3a386
font_02_sfnt_off00010de1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DE1 10684 bytes
SHA-256: 8f0a7f008f567a9a1f6bc28a5b25816c69d778edbc47ef244624d5a848f7e6ef
font_03_sfnt_off00013291.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13291 16036 bytes
SHA-256: 9559dd1bd908241551916101fda3d445a26f5c4b506a1423f23393456f9d5940
font_04_sfnt_off000146fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x146FA 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333
font_05_sfnt_off000154ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x154AD 1736 bytes
SHA-256: 5095ccdfdd328c3f25b1766e9c65bca58fa839170fcb9f3db3c20e130d955aff

Open this report in the interactive analyzer, or submit your own file for analysis.