Malicious PDF — malware analysis report

Static analysis result for SHA-256 de943c6c2bd8bab8…

MALICIOUS

PDF

74.6 KB Created: 2020-12-15 22:31:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: f65eb28844b71f70a7bdf21d879a2a91 SHA-1: e5aaeefab58e8a064e87e90fd9990d638fe75329 SHA-256: de943c6c2bd8bab8e8cc0ab7646b58b372085f0f08d22522cd141e0925fa5d4d
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'https://traffset.ru/123?utm_term=www+engvid+com+english', which is a strong indicator of a phishing or malware distribution attempt. The PDF structure itself does not contain readable content, but the presence of the external URI is sufficient to infer a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=www+engvid+com+english PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4369774/normal_5fcf9e2635ebe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369143/normal_5f8b60ae2b156.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471513/normal_5fd279b0bdbd2.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368972/normal_5fc6397b6f6fd.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454290/normal_5fa6581fb741a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc00570a3bf4b14aba44e61/t/5fcf757576f3eb1a46e4cdc4/1607431541653/rally_championship_2000_download_pl.pdfIn PDF document text
    • https://s3.amazonaws.com/tipikaxe/a_twitter_application.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5bce68787e879898d1666/t/5fd717487fc52c20693d03a0/1607931733311/template_iraq_civil_war_map.pdfIn PDF document text
    • https://s3.amazonaws.com/babuxufarizuxur/14754503682.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/889f769c-31ae-4165-9a9e-58d47314f1d3/60799677877.pdfIn PDF document text
    • https://s3.amazonaws.com/poguvelefa/oreiller_ergonomique__mmoire_de_forme.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dd518109-afa8-444c-adb6-1d83650eaac5/dozejanitifu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/434d94ec-f850-4ca3-a48d-717de6ef8d7e/43908545835.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c4f11fc-f378-4e30-a1a9-c2984210c0e2/fejiketerowiguvawumag.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c94e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC94E 5212 bytes
SHA-256: dcc53883c6f605829699f2ede42fd501d8b94de83124343f81e09daf6207f6e1
font_01_sfnt_off0000daff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDAFF 1800 bytes
SHA-256: a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620
font_02_sfnt_off0000e38c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE38C 10996 bytes
SHA-256: 087aebd3c35a04052d2e5d89022c509fb5ccb1bf838707ce1e05c66c5acac954
font_03_sfnt_off000107f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107F2 16168 bytes
SHA-256: 8c1e3298cb301b6aa2c2aeff0a89e1cafee6626e56d5ffa98ad52a7598c40df9

Open this report in the interactive analyzer, or submit your own file for analysis.