Malicious PDF — malware analysis report

Static analysis result for SHA-256 8adcfcda5ca3ea2f…

MALICIOUS

PDF

84.8 KB Created: 2021-01-10 18:04:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 901a84ed15b9be9198b103f6676e6a46 SHA-1: e60c50eafa86aab5b544546ef199c2fc0beeb822 SHA-256: 8adcfcda5ca3ea2fdbdcf8859be39e453aa4077c8c64f49f4f13466e796628c5
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'traffine.ru', which is likely a malicious domain used for phishing or malware distribution. The document body, though heavily obfuscated, suggests a lure related to a 'Joule's experiment ppt'. No scripts were extracted, but the presence of an external URI strongly indicates a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=joule%2527s+experiment+ppt PDF link annotation
    • https://cdn.sqhk.co/kisereta/hgTjchb/buvanunizej.pdfIn PDF document text
    • https://cdn.sqhk.co/tosijoxopum/rjjAFpZ/pacsun_return_policy_online.pdfIn PDF document text
    • https://cdn.sqhk.co/tubawonidas/haiZGhh/celestial_seasonings_tension_tamer_tea_safe_during_pregnancy.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417308/normal_5fbc72b217577.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387808/normal_5f91f8295dd75.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421039/normal_5fc157ce71816.pdfIn PDF document text
    • https://cdn.sqhk.co/vakamuzawa/ihia3ha/57943842773.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413714/normal_5fe1bbc753bac.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4420600/normal_5fe159ba106b1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4365542/normal_5ff30951d2739.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/woxorojero/medusa_turritopsis_nutricula.pdfIn PDF document text
    • https://s3.amazonaws.com/juduk/ielts_writing_task_2_template.pdfIn PDF document text
    • https://s3.amazonaws.com/rirusozo/63003815580.pdfIn PDF document text
    • https://s3.amazonaws.com/bevekizadoxuj/black_ops_4_zombies_voyage_of_despair_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/gezetega/journal_of_applied_microbiology_author_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/jebokizez/13391705485.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e569.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE569 1780 bytes
SHA-256: 81e0a764fdbc9791166b20ae2935f2309876bacd3d150e4c5eb7fcad2c96a944
font_01_sfnt_off0000eddb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEDDB 3492 bytes
SHA-256: eda1bcca0d6ea4e430f290044e7e349fa0e04c4b7e384188bdfbebd2bc8c8802
font_02_sfnt_off0000fa67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA67 4844 bytes
SHA-256: 83f68a8ebdedf6660054b1e548f63bb3375239f91311ec50468ad0960921e570
font_03_sfnt_off00010ad8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10AD8 11108 bytes
SHA-256: 89b8e2019cab579e52f7018a2adf699c5801b9cde1d3af4959bc074f4b04323c
font_04_sfnt_off000130c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x130C4 16036 bytes
SHA-256: 9559dd1bd908241551916101fda3d445a26f5c4b506a1423f23393456f9d5940

Open this report in the interactive analyzer, or submit your own file for analysis.