Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2e5c2465310e1fd…

MALICIOUS

PDF

60.3 KB Created: 2020-12-04 00:04:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: bb7cf1904157db33cd5910e891d57cab SHA-1: 5921ff428b16bb74e9972b3b8a36b008da77571b SHA-256: c2e5c2465310e1fd7d12b89150498fc8c58f35446592d83970cf3b90d78ee2da
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a critical heuristic firing for a malicious redirector link pointing to 'traffine.ru'. This indicates the document is designed to redirect users to a potentially harmful website. The ML classifier also strongly flagged this PDF as malicious. While no scripts were extracted, the presence of a malicious URL is sufficient evidence of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=fisher+price+toddler+rocker+batteries In PDF document text
    • https://cdn-cms.f-static.net/uploads/4365584/normal_5fa5ea8d38d4f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452846/normal_5fa245e6bd677.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc1c049c6d9645836281f45/t/5fc739f9b2fa4660c8d009a3/1606892025792/cupcake_jemma_recipes_vanilla_cupcake.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf60b2f8cdb769c6daa019/1606377651102/catholic_parish_finance_council_guidelines.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc00f8e11f6a41984810e13/t/5fc64b8a2dd96f5918c32829/1606830987372/87115847750.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc169c2bf71053ccb13c602/t/5fc57cb861e25426e1f28ad4/1606778041247/vipkid_mock_class_fail.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf603d64571256543298b6/1606377533293/pafufozenabusoxas.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf6105eaf37e3b64938efb/1606377733476/four_major_plant_phyla.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2cdea75d-e447-482a-887c-84981a24e11a/lurirajod.pdfIn PDF document text
    • https://s3.amazonaws.com/varolexexus/pathfinder_mirror_image_and_displacement.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc59cdf16f6d44b07de9ac5/t/5fc913cfaa221f7ca2b97e3a/1607013328703/rusaduzibon.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0abc6bda9c57a97bd16fd/t/5fc1e2053c6ccf69f3a27770/1606541829970/dagelevo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe0b2b6457125654015df4/1606290220418/650845600.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe237b173fb5383b6b362d/1606296443518/77369928880.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc54804c89e1c4b8fdb8c21/t/5fc96005583b2c5781eca3cc/1607032841135/gusinul.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a82a699c-f2f3-47b9-9391-be20a81bf2ad/19188801892.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b03a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB03A 5320 bytes
SHA-256: 266c497dba48180b3b2647330ab875b4e77d2bd1a0ec0d3775b7c6fe8532aa59
font_01_sfnt_off0000c241.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC241 9984 bytes
SHA-256: b2e48dc8ba42ea343f6a52164fb1cf86f0093fb63c38fcae400c42ceb7856d2e

Open this report in the interactive analyzer, or submit your own file for analysis.