Malicious PDF — malware analysis report

Static analysis result for SHA-256 dca7c1274a86683b…

MALICIOUS

PDF

134.6 KB Created: 2021-01-03 10:05:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 7f295adaa64e9ca4159a5c41f2636185 SHA-1: eb896bc4289153ac43c05b8ae03cb4bf0a3f0763 SHA-256: dca7c1274a86683b6362bb8fac8f4a073ec6aaae281bdef2fc04e9cfcde0b6a7
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, identified as 'traffine.ru', which is disguised as a 'vacation request forms for employees'. This strongly suggests a phishing or malware distribution attempt. The ML classifier and ClamAV detection further corroborate the malicious nature of the file. No scripts were extracted, but the embedded URL is the primary indicator of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/123?utm_term=vacation+request+forms+for+employees In PDF document text
    • https://static.s123-cdn-static.com/uploads/4465908/normal_5feec12ebd27f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393348/normal_5fa04fffedbd6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4405409/normal_5f928590594b7.pdfIn PDF document text
    • https://cdn.sqhk.co/jobiwokojo/ihcighc/30678704977.pdfIn PDF document text
    • https://cdn.sqhk.co/xobupuwulawe/Oqhbfge/scent_of_a_woman_trailer_deutsch.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kizugokofo/12360679181.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c00912e-42c8-4000-9f9b-de7febe75816/minemujo.pdfIn PDF document text
    • https://s3.amazonaws.com/jivagajamav/52016948888.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4690eb2a-d592-4cd8-b939-a0cdeb0238ae/masusas.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/df38c1b0-0ce1-486f-a697-b460af13c154/tefokupugigumo.pdfIn PDF document text
    • https://s3.amazonaws.com/bopuxosavubare/71053822830.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/04b96daa-d30d-4281-acb2-2b313f39a1f4/medical_surgical_nursing_lewis_book.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a0a52bec-d5bd-49ee-8d4f-2443f03db442/4650108142.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2abd0d13-47d9-46fc-90dc-d5fd326aedb5/nitoritedomoliwogejajol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a176a0c2-ee4b-476d-9922-5ffa24ac7a8a/5106166766.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001aa22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AA22 5972 bytes
SHA-256: 7a2adf9d55e4b22f7926966c51f98f6d937459529968048f5e1ba301d5a99c63
font_01_sfnt_off0001be6f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1BE6F 5356 bytes
SHA-256: bff5f0e77900125aef31924e4dc794ed25389bcdfa7efd19ad308d58cb727661
font_02_sfnt_off0001d099.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1D099 3484 bytes
SHA-256: 1ab39e199dac25f828d8f9a497084d318f9379342eb9f276d0ec0a124474097e
font_03_sfnt_off0001ddff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1DDFF 13432 bytes
SHA-256: eb8213463c20e761790c57799de0bcb2bbd5368d574e4f0d49ac071ded4fefd1

Open this report in the interactive analyzer, or submit your own file for analysis.