Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e55c1f9580f43b0…

MALICIOUS

PDF

91.3 KB Created: 2021-01-12 14:22:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23
MD5: 178b78fc321a014e6560bbacc8c9782f SHA-1: 97a743e2aa53578d56917e4d170afcaa6079d178 SHA-256: 7e55c1f9580f43b0e33b251d1ea568cf4ef11eddabb52dc4898113726646dc15
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a machine learning classifier and ClamAV, indicating malicious intent. It contains an embedded URI pointing to 'traffnew.ru', which is likely a lure to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a theme related to a game, likely to entice users to click the malicious link. No scripts were extracted, but the presence of external URLs and the overall detection profile strongly suggest a phishing or downloader attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/wb?keyword=scooby%20doo%20escape%20the%20haunted%20mansion%20game PDF link annotation
    • https://cdn.sqhk.co/susojitigi/ojcdicO/beturetekagifofad.pdfIn PDF document text
    • https://cdn.sqhk.co/vovewotutal/a7agjje/77828052014.pdfIn PDF document text
    • https://cdn.sqhk.co/wuluzajiroz/frL4hjA/ates_ve_su_1_oyna_her_oyun.pdfIn PDF document text
    • https://cdn.sqhk.co/barugogip/OgiiUXQ/management_consulting_firms_nyc.pdfIn PDF document text
    • https://site-1175164.mozfiles.com/files/1175164/49629802836.pdfIn PDF document text
    • https://cdn.sqhk.co/japexexuko/MkI0Ujg/53255473484.pdfIn PDF document text
    • https://cdn.sqhk.co/biposuba/OiiMiaB/29813199414.pdfIn PDF document text
    • https://cdn.sqhk.co/baxalelizop/xQjalie/robot_slicer_ninja_crafter.pdfIn PDF document text
    • https://site-1172117.mozfiles.com/files/1172117/army_relation_bharti_2019_list.pdfIn PDF document text
    • https://site-1171851.mozfiles.com/files/1171851/59588833827.pdfIn PDF document text
    • https://site-1179337.mozfiles.com/files/1179337/rapobukajebetub.pdfIn PDF document text
    • https://site-1168410.mozfiles.com/files/1168410/jupekitedofedodusibapod.pdfIn PDF document text
    • https://cdn.sqhk.co/wemigiwim/ibxNhcz/diadora_shoes_review.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4464527/normal_5fc7be651925c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011718.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11718 6660 bytes
SHA-256: 891a6311cb3d648d3a622ddda64d5ff525ebd2cd147e2cc8b7043ee9ebc30b99
font_01_sfnt_off000127ca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x127CA 5704 bytes
SHA-256: eb098a195e7170f84533405b3bdc94373fe85be068d238ab5cf774e2ac75af6f
font_02_sfnt_off00013b14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13B14 10704 bytes
SHA-256: 1ce3a5e45334d090a6ece7e6f3e929cfd7f3b7e8623e7566a5d434257d444b35

Open this report in the interactive analyzer, or submit your own file for analysis.