Malicious PDF — malware analysis report

Static analysis result for SHA-256 baf9d01c1302ff2a…

MALICIOUS

PDF

72.0 KB Created: 2020-12-22 10:09:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 1d2344a937ceef12ffd4877c697fa9b8 SHA-1: d6be3d70e41c19bc8970fb65bee3ba0b25ba0b98 SHA-256: baf9d01c1302ff2aa0a067540f2f6aa1ff91834c0f625a89b0304ed7187643e5
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URL pointing to 'traffnew.ru', which is likely used for phishing or to download a secondary payload. The document body, though partially corrupted, suggests a lure related to a 'series guide apk'. No scripts were extracted, but the presence of an external URI and the overall detection profile strongly indicate a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?utm_term=series+guide+apk PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4373768/normal_5fab62fdeb396.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456686/normal_5fb291d4dfdd2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368998/normal_5fab541cd7ac5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/38603cbe-0aff-42cf-b8b8-cc877b3da5e5/target_mission_valley_hours.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0545296-dc89-468e-95d9-78af694fdcd7/40970839788.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc575db16f6d44b07dd545c/t/5fd62a5dffab5d3c56f30070/1607871070431/fathers_day_cards_printable_templates.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b0792c16-5c46-48c3-9af3-3a62cb8d2d5d/6920091750.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d1b5c872-f792-474b-bbc0-bf59310dd6b5/89129354075.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f46ff990-29ac-4d07-8195-5bd959f593e1/a10_games_unblocked.pdfIn PDF document text
    • https://s3.amazonaws.com/vososasoxumete/boxing_game_please.pdfIn PDF document text
    • https://s3.amazonaws.com/tometubufimopim/rugit.pdfIn PDF document text
    • https://s3.amazonaws.com/dobikasukavu/15569344408.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2f9eaa3bf4b14abb69cf4/t/5fcebc90866f6d0e869c280f/1607384208929/gta_sa_ben_10_mod_gamemodding.pdfIn PDF document text
    • https://s3.amazonaws.com/mibiwivanetuj/monster_arena_drops_ffx_remastered.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d9565874-5aaf-41d0-9f85-c9f2ff522ceb/15803647842.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000daba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDABA 5260 bytes
SHA-256: 47d33446f414d27df7c4fd4400085fffe5df7616a91f7b770b5b8ca8e8b42ee7
font_01_sfnt_off0000ecae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECAE 12924 bytes
SHA-256: 8a0ea740038a06fc146cd7624483d5f563dd5d69766672e4e97e0a7c35a47674

Open this report in the interactive analyzer, or submit your own file for analysis.