Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ad22114386e0e1c…

MALICIOUS

PDF

64.9 KB Created: 2020-12-18 20:41:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 3ee92be7b919dfa132f6bdd3c3cd3115 SHA-1: a899f5a2d79d1c2404fc881e4a51b8781015511d SHA-256: 8ad22114386e0e1cec655af89bba8bb3a3534c923d2660c08f0fde0564c7e1fa
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that was flagged by ClamAV as a phishing trojan. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates that the document likely contains instructions to open a password-protected archive, a common tactic to evade gateway scanning. The embedded URL 'https://trafffe.ru/aws?utm_term=bang+bang+english+song+ringtone' is suspicious and likely serves as a download source for a malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/aws?utm_term=bang+bang+english+song+ringtone PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4403806/normal_5f95f54aeb729.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4483839/normal_5faf5bed2b9a9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/lorugipopuxe/98569149716.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f7e6228-9ff0-4445-b9d1-2394a100991d/lalodadupawubesimowirim.pdfIn PDF document text
    • https://s3.amazonaws.com/palikuvexake/kenume.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc55e6e085bf90c0e1aeabc/t/5fd1aea9133bcb3b889bfe79/1607577258566/juventus_vs_real_madrid.pdfIn PDF document text
    • https://s3.amazonaws.com/lemefofutomapox/acdis_ccds_exam_study_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/sojuravewi/new_android_tv_apps_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/tugumeb/achey_tree_osrs.pdfIn PDF document text
    • https://s3.amazonaws.com/gorajikunobixi/nellie_ohr_radio.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bb44ef5-bd54-451d-af6d-4cae39e8da3b/lugirovegazujedevuno.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c199.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC199 5136 bytes
SHA-256: 1159e49db40ec75cb32f55fbb08ac3973e88c0421f8c29133e0bd6da424ea0b4
font_01_sfnt_off0000d307.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD307 10612 bytes
SHA-256: df386666c9e6d53bf25cdcf1179a70924f1e72aa8054a84bf73b48e2897a45ba

Open this report in the interactive analyzer, or submit your own file for analysis.