Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5b15155d1deda35…

MALICIOUS

PDF

117.4 KB Created: 2020-12-17 23:07:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e611353229ef03be2961784c1688b5b3 SHA-1: 15bd23c4d52498c5c0250fc0e41ff8b95b17d749 SHA-256: d5b15155d1deda352d74b1676b20d86d8dfbf1ff037d51add5f96378b8d457ee
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains numerous external links, with one prominent URL pointing to 'trafffe.ru', suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references to 'Dino run 2 play' and 'wkhtmltopdf', indicating a potential lure to a fake game or resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/strik?utm_term=dino+run+2+play
    • https://mulivora.weebly.com/uploads/1/3/4/3/134382764/samedaxovagokuwukot.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/a8e39af9-a83c-4a0d-b903-6541237c7ba2/gemuvagaw.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe4c519b1ed03538a82ac4/1606306897400/ecological_niche_worksheet_answers.pdf
    • https://static1.squarespace.com/static/5fc6a41824b06a7eb327987d/t/5fd6571596ed101a3e3e7e53/1607882518071/grammar_practice_worksheets_high_school.pdf
    • https://static1.squarespace.com/static/5fc56dbc92c50b1a1e95e2fe/t/5fcac6a574c1090e462a2b9a/1607124650416/allegiant_customer_service_after_hours.pdf
    • https://uploads.strikinglycdn.com/files/2f23b670-fc85-4e75-a1e9-b2ff2a8c688a/trumpet_voluntary_piano_sheet_music.pdf
    • https://uploads.strikinglycdn.com/files/77e14572-79be-43f2-9565-270cf08f029c/csv_to_mdb_converter.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd06592c6de34c7a3a1603/1606223449797/oquaga_creek_state_park_camping.pdf
    • https://uploads.strikinglycdn.com/files/c4674907-aea9-4f74-9cb5-b1eb543f9546/83902342155.pdf
    • https://uploads.strikinglycdn.com/files/88fdc970-11cc-4a01-b63a-a5473d710a91/nectar_in_a_sieve_summary_litcharts.pdf
    • https://static1.squarespace.com/static/5fce37932ebf7d3ac6444665/t/5fd6d5af102ca46975f502a5/1607914928643/report_erratic_driving_vic.pdf
    • https://s3.amazonaws.com/midipes/64804906531.pdf
    • https://static1.squarespace.com/static/5fc6f6291a9b7f647934c66b/t/5fd6da70034a586a4f55deba/1607916145006/bahubali_2_malayalam_songs_free_starmusiq.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018ef4.bin
9dd735fe13a70e71bf081d77ecdee9edda834e1d8e4a26c169485bfa75ac856e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18EF4 4868 bytes
font_01_sfnt_off00019f9e.bin
f03e877fdbde27a66e97f7494b8441cf15423a31f4ac81b5e6ad7a71444caa41		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19F9E 13244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.