Malicious PDF — malware analysis report

Static analysis result for SHA-256 847169c4e7772ac2…

MALICIOUS

PDF

133.9 KB Created: 2020-12-19 18:21:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2b46776311228eaf9dba86d3055d4023 SHA-1: 732202dbd1192615de1f29cad59d9dca873683ac SHA-256: 847169c4e7772ac20fb7bcd8450195bf7c8bfb589f8eace59bc18bb18633ac40
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, specifically 'https://trafftec.ru/aws?utm_term=wingdings+alphabet+pdf'. The ClamAV detection 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0' strongly suggests malicious intent, likely phishing. The document body, though heavily obfuscated, contains references to 'Wingdings alphabet pdf' and 'wkhtmltopdf', indicating a lure to a potentially malicious website.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3257

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?utm_term=wingdings+alphabet+pdf
    • https://cdn-cms.f-static.net/uploads/4377400/normal_5fbf18d69bb68.pdf
    • https://static.s123-cdn-static.com/uploads/4413002/normal_5fcb57f2cad27.pdf
    • https://cdn-cms.f-static.net/uploads/4380079/normal_5f96625711947.pdf
    • https://cdn-cms.f-static.net/uploads/4369762/normal_5f8bec0b14d59.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf518e61e25426e12f4b70/1606373775314/namivetajivonogomuxugola.pdf
    • https://uploads.strikinglycdn.com/files/5924d051-bbf1-48d3-b2ff-d915e2a9e6c5/vunarolivuxerubor.pdf
    • https://uploads.strikinglycdn.com/files/d432de9b-9fef-4396-a0ac-debda629f214/wazunabujok.pdf
    • https://s3.amazonaws.com/jafujasiwetid/baystate_reference_labs_east_longmeadow.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee22.bin
b5ff9972eeb34355c3e8aa5279d5096e071d8e2e568cfa43681059bb1c40151e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE22 7044 bytes
font_01_sfnt_off00010006.bin
efeee12010c59c0d2c0742bffedd9ed82e6d6de0c82a841046fc411362ae50d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10006 3036 bytes
font_02_sfnt_off00010acf.bin
0438cc4f2dc9d82c3793e64342f281a96d125f6e289b04adc86e066afe267956		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10ACF 5360 bytes
font_03_sfnt_off00011cd7.bin
60a4bd9856d8ba0e6d0d50feb54e62bef24937e7cb0a5dfe216a2c171ba30086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11CD7 6212 bytes
font_04_sfnt_off00012be7.bin
0b722c4c6ba9649613f4a9097d61029ee37b4f964f91b562143a7368433ea0ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BE7 28016 bytes
font_05_sfnt_off00017570.bin
d408ded5052b9854e2eed85084cd3528e59c0edc2c5e4065b75c1810e39bcb6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17570 26596 bytes
font_06_sfnt_off0001baf1.bin
795d1eb6ca7735712853376eee86dbbc50024d17a27d4bed26f6c5bd062e43ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BAF1 32540 bytes
font_07_sfnt_off0001fe34.bin
ddc09560e4c96f9c8cfc12629ca2515bfbace636dd8c8e180588154d88f308b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FE34 2572 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.