Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad73c15106662e74…

MALICIOUS

PDF

171.5 KB Created: 2021-01-13 10:50:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 7d59189aa5b888648c847d9126307d39 SHA-1: 7ae38e6acfcc5f99083c3650a2df3cb3e54e93da SHA-256: ad73c15106662e74d2c9844ce9891bde1e197e9e0c879f7f77d8944e06a55d74
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://trafftec.ru/123?utm_term=st+faustina+diary+1760', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to a diary entry.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=st+faustina+diary+1760 PDF link annotation
    • https://cdn.sqhk.co/rosomugimo/XvJdR28/wagefesumotevamada.pdfIn PDF document text
    • https://dojilosadokadog.weebly.com/uploads/1/3/4/8/134890500/pejeloponinibozel.pdfIn PDF document text
    • https://cdn.sqhk.co/sevimifogu/ijjjagc/35150202894.pdfIn PDF document text
    • https://cdn.sqhk.co/pekuwalixeso/shggiyP/download_game_perfect_slices_mod_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/nupasoxure/hfjgrhd/why_did_my_middle_finger_emoji_disappeared.pdfIn PDF document text
    • https://cdn.sqhk.co/devisofage/igUqrhc/airport_airlines_air_traffic_control.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/benuka/bachelor_thesis_physics.pdfIn PDF document text
    • https://s3.amazonaws.com/nalifij/training_day_soundtrack_list.pdfIn PDF document text
    • https://s3.amazonaws.com/pizexopenaxu/guide_for_stock_market_investment.pdfIn PDF document text
    • https://s3.amazonaws.com/nagudo/zanan.pdfIn PDF document text
    • https://s3.amazonaws.com/fomaralunex/laptop_adapter_repair_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/dirijazi/wajonuxosi.pdfIn PDF document text
    • https://s3.amazonaws.com/pojikovewijeja/fannie_mae_guidelines_gift_funds.pdfIn PDF document text
    • https://s3.amazonaws.com/fixararololu/guvabiwune.pdfIn PDF document text
    • https://s3.amazonaws.com/kefodek/28709050751.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00025d0d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x25D0D 5504 bytes
SHA-256: f77fa820ecc2dd991a6e8112755974295a9dd3edcd9fe21c0d4dc659832db0c6
font_01_sfnt_off00026fe2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26FE2 3720 bytes
SHA-256: d5ecec3e822993868ba70e247019bcdb656a9fee58d620eb93bc70658e929280
font_02_sfnt_off00027b45.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27B45 10692 bytes
SHA-256: e7097337b6370298a760bad3b25513a0d66a1a2c88f27565b90b56508610ebf1

Open this report in the interactive analyzer, or submit your own file for analysis.