Malicious PDF — malware analysis report

Static analysis result for SHA-256 90ab3258aca84711…

MALICIOUS

PDF

76.9 KB Created: 2021-01-04 17:23:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: c7b2319cd6159018219e68d64d39651d SHA-1: ef9fc1d3d554cebed7b54e7777a19033a724a2d6 SHA-256: 90ab3258aca847116d3788e38184e92ba0fe19387b2f42733202267ce1d766e3
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'trafficel.ru' which is likely used to redirect the user to a malicious site, possibly related to the 'Netflix app' lure. While no scripts were explicitly extracted, the PDF format can embed JavaScript, and the presence of external URIs suggests an attempt to download or redirect to a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=netflix+app+en+op+macbook PDF link annotation
    • https://cdn.sqhk.co/mofosalamo/heVlhh4/glider_simulator_online.pdfIn PDF document text
    • https://cdn.sqhk.co/dakuwuwuzije/djdJF6T/fexesowazapusaxuvidilovut.pdfIn PDF document text
    • https://cdn.sqhk.co/nawafoxobok/lhfjaqM/the_sims_4_cheats_money_0.pdfIn PDF document text
    • https://cdn.sqhk.co/zoboxoba/8gijjgi/anime_character_maker_unblocked.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/wipotegadodorek/28951243279.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1be6ed8c-3399-48b0-990e-29c827685419/petroleo_ventajas_y_desventajas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d55f231-b10a-4e44-9bdb-f69dbbec0f41/5997573808.pdfIn PDF document text
    • https://s3.amazonaws.com/laradusa/72998572074.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f656901b-2aec-47cf-b16c-c9a48b78223d/vubarasiwukogugilifet.pdfIn PDF document text
    • https://s3.amazonaws.com/kavitokolezub/40990683484.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bdf75d1a-ce3c-4fa8-a6a9-081fc7029db4/3_way_pool_game.pdfIn PDF document text
    • https://s3.amazonaws.com/jijumupade/tagotafevikile.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6aad57c6-3011-482b-b2c5-975145fc118a/siwodiwa.pdfIn PDF document text
    • https://s3.amazonaws.com/rimejiguvif/redneck_manifesto.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e425.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE425 4916 bytes
SHA-256: a99ca0fb404e1f2822fb70994e1fbf5f281c512c31447d2cbaee72a2dc05813a
font_01_sfnt_off0000f4c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF4C9 10520 bytes
SHA-256: 5ecdc18d960ba5067c0f4522ace511da30b24c2bb9369662c9c438709a0380b1
font_02_sfnt_off000118cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118CD 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.