Malicious PDF — malware analysis report

Static analysis result for SHA-256 c02bf01255718f37…

MALICIOUS

PDF

65.9 KB Created: 2020-12-22 04:44:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 70e6b62b7ce7d9efb8825e29fe6c6cb7 SHA-1: ecf408868907f3c009e74043d5643b9608bd71ce SHA-256: c02bf01255718f372030301cec3b92ef3f69f8afa698f6498df180fc39de640d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, specifically 'https://traffnew.ru/strik?utm_term=monkey+go+happy+5+walkthrough+level+12'. The document body, though heavily obfuscated, contains text that appears to be a lure related to a game walkthrough. ClamAV also detected this file as 'Pdf.Phishing.Trojan'. The combination of these factors strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/strik?utm_term=monkey+go+happy+5+walkthrough+level+12 PDF link annotation
    • https://mubatizusilaboj.weebly.com/uploads/1/3/4/4/134475350/totomedovuken-wifesejoweb-gatofifisulufek.pdfIn PDF document text
    • https://piramejujidizek.weebly.com/uploads/1/3/4/6/134694247/7bac6324af.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490116/normal_5fdc4fcb1995e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421466/normal_5faa7ae579cdd.pdfIn PDF document text
    • https://wezenazuzive.weebly.com/uploads/1/3/4/7/134764498/f8428cf.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6752836f-a333-479a-8e2f-d9dede77504a/zomineniwinogud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/51db7abd-407d-4b0b-a36e-56ef35a96e16/5390265826.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/286bcafc-4bef-489e-a88f-68e08f8d5772/10203134682.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1c4f9c72-358e-4656-8e90-c527d7cd2e01/old_roblox_website_simulator.pdfIn PDF document text
    • https://s3.amazonaws.com/mujevubutukoxu/macros_spreadsheet_templates.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/192e6629-8134-491b-833c-3bc88a8846bd/takeuchi_tl130_owners_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3edc5992-358f-4cf1-8a82-d7269566d446/fikoga.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6407e368-9fbf-49e2-aae1-bd6dc5235848/rough_guide_or_lonely_planet_spain.pdfIn PDF document text
    • https://s3.amazonaws.com/zewimu/42557967017.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c3f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC3F5 5532 bytes
SHA-256: 3da81dd6535f9b584350e5cc1f420222e379a7a83254816b87ebb48286469060
font_01_sfnt_off0000d6fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6FD 10588 bytes
SHA-256: 8d0417568269218236168a0d0289e75ea1c1ee5828748c44265b0eb011264919

Open this report in the interactive analyzer, or submit your own file for analysis.