Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7716437ce121269…

MALICIOUS

PDF

69.6 KB Created: 2020-12-18 18:46:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f4a92d8116ba413f7201bdbbdd9add66 SHA-1: 560434e2b17c8077979a0ebdfb92792f10b2266e SHA-256: d7716437ce121269e49d9dae9147caa66e7146b76f3b88e37a699f862ddd5f44
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, traffking.ru, which is likely used to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a lure related to 'Skyrim dark brotherhood members', indicating a social engineering attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/strik?utm_term=skyrim+dark+brotherhood+members
    • https://xinufagepowe.weebly.com/uploads/1/3/4/4/134437511/sepekugozura_xitagidari.pdf
    • https://rikurifijuse.weebly.com/uploads/1/3/4/6/134681474/4130a012120f.pdf
    • https://gaxasonazeg.weebly.com/uploads/1/3/4/3/134375181/kenekuxawuxor_gukufijaferej.pdf
    • https://sugelazo.weebly.com/uploads/1/3/4/7/134767002/f62f65cb9daa.pdf
    • https://jurizimobijagi.weebly.com/uploads/1/3/0/8/130874317/1789070.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f6d58d00-6b1e-4aeb-ab6d-a4532210ba67/d_d_5e_arcane_archer_guide.pdf
    • https://uploads.strikinglycdn.com/files/431fc9eb-84c5-4954-9e3e-46be10ebf918/war_room_meaning.pdf
    • https://static1.squarespace.com/static/5fc5d1c924b06a7eb32152dd/t/5fd21cdfac13f65f661bafd5/1607605475739/best_second_hand_clothes_shops_sydney.pdf
    • https://s3.amazonaws.com/wiwuxot/barcode_reader_for_android_free.pdf
    • https://static1.squarespace.com/static/5fc19923a3bf4b14abae1a5b/t/5fd1221310275a0b908effa5/1607541271547/vejogofabukepapibizev.pdf
    • https://static1.squarespace.com/static/5fc537998787e879898820f8/t/5fc7096fad3e6411923c8261/1606879600414/paralyzed_synonyms_and_antonyms.pdf
    • https://s3.amazonaws.com/lebaxa/19181034150.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbdf0bb3c02f22b9dd248a0/1606283452429/61708251855.pdf
    • https://static1.squarespace.com/static/5fc1758ebe9b6939510ebb53/t/5fcc6c978a55f2188b6f4fc5/1607232664065/libajawizorutajuku.pdf
    • https://static1.squarespace.com/static/5fc11355ab79f442f22aa123/t/5fc14ce77acac6192af0de41/1606503655433/introduction_to_literature.pdf
    • https://static1.squarespace.com/static/5fc28a8211f6a41984901fa4/t/5fc6904b1972c46e3c83d53d/1606848587549/island_adventures_port_angeles_reviews.pdf
    • https://s3.amazonaws.com/juzinaramip/24952981279.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cff2.bin
bd5c507d63fc7375a155768aa63c5df2b502a6dbd4452325f793249ed2f8d83d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCFF2 5440 bytes
font_01_sfnt_off0000e248.bin
91ffbf967083dfb4a4c560545295ab45f9e2fecfd51fe99e96f76f2f2c3c4a74		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE248 12228 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.