Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7f1a879b2bb256c…

MALICIOUS

PDF

66.6 KB Created: 2021-01-03 03:12:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 38479b29fe757ac3d2736c02214e265c SHA-1: cb45f80babf2ee0d315b4b00ef3af099a30f1fe5 SHA-256: c7f1a879b2bb256c5461c82ff6cd05985bdc8da959dd1206c527bcda88a05383
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'trafficel.ru', which is likely a phishing lure. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=banco+votorantim+s.+a.+annual+report
    • https://static.s123-cdn-static.com/uploads/4501645/normal_5fdeb45cd6af7.pdf
    • https://cdn.sqhk.co/xeposetuge/hh7ihc3/80911594706.pdf
    • https://static.s123-cdn-static.com/uploads/4444104/normal_5ff036c027059.pdf
    • https://cdn-cms.f-static.net/uploads/4392659/normal_5f91516404271.pdf
    • https://cdn-cms.f-static.net/uploads/4454977/normal_5fbf135249945.pdf
    • https://cdn-cms.f-static.net/uploads/4454545/normal_5fbf62a37c078.pdf
    • https://static.s123-cdn-static.com/uploads/4386091/normal_5fe10b94d1b20.pdf
    • https://cdn-cms.f-static.net/uploads/4466367/normal_5fd24de021f22.pdf
    • https://cdn-cms.f-static.net/uploads/4465709/normal_5fd3b5ed346cb.pdf
    • https://static.s123-cdn-static.com/uploads/4385852/normal_5ff088b099aec.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/13a83451-cd16-4b45-9d07-99c0e86f5e2b/boveketodiwabaruvonowel.pdf
    • https://uploads.strikinglycdn.com/files/e1f057a2-164b-44e1-91a5-52dd9ded18dd/red_sunglasses_for_chickens.pdf
    • https://uploads.strikinglycdn.com/files/a7f423a2-28e9-4c9d-9aa2-a7c57ce70371/physics_ee_topics_mechanics.pdf
    • https://uploads.strikinglycdn.com/files/329e3594-32c0-4a03-9440-1c3e9c60653f/la_magia_del_orden_marie_kondo.pdf
    • https://uploads.strikinglycdn.com/files/baf7e396-38ac-4113-9d45-8dbcdb217b5e/the_bramble_bush.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cbdf.bin
70ce61847e8bde8673fb4a2b58a3c47471a6da70c3273420420e3737644ff9e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCBDF 5220 bytes
font_01_sfnt_off0000dd98.bin
ee91eb0b60bbc1d8344b709e0d001a9fe8173df7ca7281c3c1d0ea8766ccfae5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD98 10584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.