Malicious PDF — malware analysis report

Static analysis result for SHA-256 beda1980594a1b7b…

MALICIOUS

PDF

160.7 KB Created: 2020-12-02 20:03:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-24
MD5: 16c7b7828ce871a2fb814b4cbeda32b0 SHA-1: 1540fb23182db8085e3c46036c1c4d559a46604d SHA-256: beda1980594a1b7be3a2aae38daf58e6d60f43c274fd631920a8ad0057e362ae
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. An external URI pointing to 'trafftec.ru' was extracted, suggesting the document's purpose is to redirect the user to a potentially harmful site. No scripts were extracted, but the PDF structure and embedded URL are strong indicators of a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=rocket+young+justice+husband PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4371553/normal_5faa5b0f3e4af.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/buxoparadazegu/86399954818.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1425117e7202640ec9856/t/5fc502a55147b14804d05f40/1606746789389/62878638135.pdfIn PDF document text
    • https://s3.amazonaws.com/zijivevip/dietetico_in_english.pdfIn PDF document text
    • https://s3.amazonaws.com/tubupejevomo/13300063673.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9330f7f8-4eb7-4b6d-8ad1-311e36ea89f5/spartanburg_methodist_college_baseball_roster.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f93c88b1-2603-4d41-b7dc-55c652f4e686/47740447471.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8618a08e-3ab9-4412-8d8e-8a5ea488b4c6/bukelene.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5ac7d1a-2bde-4a6a-b514-2f4efeed34a0/algebra_worksheets_grade_9.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2b689652-01ae-47e5-b8ea-470149650f9f/92730907333.pdfIn PDF document text
    • https://s3.amazonaws.com/bajapovogam/rimeka.pdfIn PDF document text
    • https://s3.amazonaws.com/felasorarabipis/add_and_subtract_mixed_numbers_with_unlike_denominators_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/vavejijitatofu/47662154300.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc2afeac6d96458362da14e/t/5fc53db05147b14804dd5aa7/1606761905016/impresora_ricoh_aficio_mp_201spf_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/regufojalojaza/kelusuxagex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/724a8b86-944b-45d3-9246-ec66e63cf577/central_perk_logo_vector.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00022e51.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22E51 5344 bytes
SHA-256: 0c4cb740947842e8efa7648bf2a40cb6d6e4e159631b866dcc52dc502b7f822e
font_01_sfnt_off0002408f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2408F 11528 bytes
SHA-256: 5e0c83dbd46efceee7c0b1626d168e82f37ec5d329447b109bfb9c2581b451b4
font_02_sfnt_off0002668f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2668F 4324 bytes
SHA-256: 05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176

Open this report in the interactive analyzer, or submit your own file for analysis.