Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3e0f75cc9822e8e…

MALICIOUS

PDF

65.6 KB Created: 2020-11-23 09:27:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 9a9c340b4067a6e64db7f09ae58e7716 SHA-1: abb428f02e3834f8f5087f09bd5d2e9ded6c2636 SHA-256: c3e0f75cc9822e8e820f658acff99678a7be21e05bcb05eaa05a5047cecd0606
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged as malicious by ClamAV and an ML classifier. It contains an embedded URL pointing to 'traffset.ru', which is a strong indicator of a phishing or malware distribution attempt. The PDF structure itself shows signs of manipulation, with duplicate object definitions, further supporting a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=body+positions+medical+terminology PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4370778/normal_5fa66ec83ca2b.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d2d3dad-9e53-413f-8e1b-7a4821e8b58f/payday_board_game_1975.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d3a2fd0-7ad5-41a1-b8e1-f9c11d72198a/redemption_manual_5.0_series.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abd08e7d-5de4-4fd1-8e13-80c01176a561/lujuvaxikafagekupage.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/72254aca-ab68-4ff0-bf9f-65ac75a9b1c6/2931459809.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf3bf94b-a2f0-4cea-9b50-2fabc151f60e/70435892264.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f8cf5d57-8040-4e19-b097-b4f480af0d29/sezuvogajeretomugaresi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b49ab38-8ed3-429e-9c48-ce1cbd936ccd/evergreen_forest_elementary_north_thurston.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce488769-a2b5-48d9-b019-bef4b6d2748d/22765380893.pdfIn PDF document text
    • https://s3.amazonaws.com/liguwubore/how_to_reset_fitbit_blaze_back_to_factory_settings.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/021b8c08-1039-4feb-a112-d94e3f179a61/democrips_and_rebloodlicans.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/09d26b24-540e-4684-bde8-932bb32ba49c/lebakulopalisu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cadb86ea-32e0-442d-a22c-338038730a0b/xinebusigipabijujoperuj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c47e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC47E 5544 bytes
SHA-256: 52093c1434c6f77c1e64d42d5089534548023234f59f93a16224d692c19aa016
font_01_sfnt_off0000d751.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD751 10144 bytes
SHA-256: e8b297ebfff50f80b32255845ad2efc3ec3824c2d34ee0ae2a3528ab3f55262f

Open this report in the interactive analyzer, or submit your own file for analysis.