Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e7afe9a2470fe60…

MALICIOUS

PDF

75.8 KB Created: 2020-12-28 08:59:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: dbb2b87d8bf79a21d4d33cc44c9d7a66 SHA-1: 7ac77bed5ec9c6228a0f463cbf1869e93f7c557b SHA-256: 7e7afe9a2470fe60a188743fd1fa32a8299e4aaae481694721e2ff588ade17c4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL 'https://traffnew.ru/aws?utm_term=arista+eos+user+manual' is presented as a user manual, suggesting a social engineering tactic to trick the user into visiting a potentially harmful site. While no scripts were explicitly extracted, the PDF structure and the presence of external URLs are common in phishing and malware distribution schemes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/aws?utm_term=arista+eos+user+manual PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/niwotipugonuvoz/backstage_swing_away_platform_hitch_rack.pdfIn PDF document text
    • https://s3.amazonaws.com/gowebabuxogiro/tawekizegesalemag.pdfIn PDF document text
    • https://s3.amazonaws.com/vifusupegiza/electromagnetic_frequency_radiation_course_exam_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/sefepugolupalax/airdroid_premium_mod_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5eb0f4ba-37d4-471f-a25e-9dd6d772ed8f/psu_rec_center_group_x_schedule.pdfIn PDF document text
    • https://s3.amazonaws.com/nelizenejakarug/jumavedigibo.pdfIn PDF document text
    • https://s3.amazonaws.com/desekusoxi/ada_guidelines_for_diabetes_screening.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66f46642-917c-4b18-89ff-f341519f1ead/sanegoxiluvaxikal.pdfIn PDF document text
    • https://s3.amazonaws.com/pegozegi/durumezaxexorodunoj.pdfIn PDF document text
    • https://s3.amazonaws.com/vikukinumet/difference_between_antiform_and_anticline_geology.pdfIn PDF document text
    • https://s3.amazonaws.com/gazivemon/rifizerilegedibibosimo.pdfIn PDF document text
    • https://s3.amazonaws.com/waxegatulo/buxisadigewukajas.pdfIn PDF document text
    • https://s3.amazonaws.com/dowesitobuga/85330262858.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED9F 4820 bytes
SHA-256: 0fd8d768b950bc129f43d7fc1058c8a2ff7e90fd25a72eea700ddd45b0c54ab9
font_01_sfnt_off0000fde5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDE5 10868 bytes
SHA-256: da355a0a7410eaed6347dd1ed74b259e19f16a0f2dc36ecd5a637244102c4b0b

Open this report in the interactive analyzer, or submit your own file for analysis.