Malicious PDF — malware analysis report

Static analysis result for SHA-256 c811a26cf30038de…

MALICIOUS

PDF

71.1 KB Created: 2020-12-17 15:54:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 9672696251044d5d71e12da9373db8b1 SHA-1: d38ce625265668cfb917b8a95cba03abce608c37 SHA-256: c811a26cf30038de9bdb5162d63d307e87a58d1382bfb5e528e58957ac82ee85
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. An external URI pointing to 'traffnew.ru' was extracted, suggesting a phishing or malware distribution attempt. The document body is heavily obfuscated, but the presence of an external URI is a strong indicator of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?utm_term=wave+echo+cave+forge+of+spells PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf1d2bc819f1cf49da136/1606283730324/modern_marvels_cheese_worksheet_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06836958-1267-42aa-a5c0-a6e77a8bc6fe/viwulazipave.pdfIn PDF document text
    • https://s3.amazonaws.com/wemupajese/bienestar_psicologico_en_el_adulto_mayor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fe2eb287-a2d8-4a79-8032-33ac95f7521f/43346431880.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48477dd2-2ec5-4899-8e9c-d9581fad9bbd/4255224403.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc53481c30a162e0c6eae90/t/5fcfce4cd75d4c4c5743444f/1607454286537/loblaws_propane_tank.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59b572ae-cccf-446a-8c02-db1ea723a15e/introduction_to_environmental_science_worksheet_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/93be4212-fe65-41e9-aae4-2ed7526a7705/best_movie_streaming_sites_free_reddit.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1571bc30a162e0c558f21/t/5fc424993c6ccf69f3e17789/1606689946965/puwonevovulanul.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/165b54dc-b26f-446f-8466-9d1c4a1b8e62/99523556964.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02606ea2-c512-45d4-aaba-72a1accdfd9c/eviction_notice_template_ontario.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53b79128-e0c7-40aa-ad66-193fc7a2a76b/93405635405.pdfIn PDF document text
    • https://s3.amazonaws.com/suzixegazunow/xalijiwowofopup.pdfIn PDF document text
    • https://s3.amazonaws.com/palevijuj/wuzupozalekovujojo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d927.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD927 5352 bytes
SHA-256: 7e6a89d7203b1f7b837cac0805dc72ef52448f44943609f39de20ad4b7a7949e
font_01_sfnt_off0000eb6f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB6F 10560 bytes
SHA-256: a344bcecc3a8bc1133c818f072765deb345d52c0a53f315303cadddd59ea37d3

Open this report in the interactive analyzer, or submit your own file for analysis.