Malicious PDF — malware analysis report

Static analysis result for SHA-256 df3175b04820b0cb…

MALICIOUS

PDF

85.9 KB Created: 2020-12-23 14:55:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: b426c941e2de8e5f898b203e32eb6197 SHA-1: 07f1c5d8957936775a9e7443f5235f2ca97a44b0 SHA-256: df3175b04820b0cbc5dd2f3eb280f039f89a6bda8814763a9590941932a1926c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a domain that appears to be used for phishing or malware distribution. The document body, though heavily obfuscated, contains text related to 'wine labels templates microsoft word', suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?utm_term=wine+labels+templates+microsoft+word PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4481515/normal_5fc8c21d97d7c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453551/normal_5fcc0c55c9530.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4454045/normal_5fde2a001b180.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/lukepepe/browsec_for_android_tablet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5de8330-e3c9-4832-8666-0f5d0052d748/afaa_primary_group_exercise_certification_study_guide_answers.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/03952122-b4de-4f4e-8bee-2010ade5ff98/27888528076.pdfIn PDF document text
    • https://s3.amazonaws.com/vunizi/aha_pals_study_guide_2015.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e59a05d-c061-4445-8376-dbe415650b17/2941686260.pdfIn PDF document text
    • https://s3.amazonaws.com/rijaliwiguvex/affiliate_noun_form.pdfIn PDF document text
    • https://s3.amazonaws.com/xumakomowi/11744384253.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/52aa8361-658c-442e-8d06-6b4f6d626bdd/46924054586.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/713ed38f-22d9-47b9-be3e-e5ffbf72315e/razejazanevuzusiripupajob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/523b3fc9-1e08-4d9a-aae3-e9ca00610a43/83348294379.pdfIn PDF document text
    • https://s3.amazonaws.com/gozilum/owners_manual_everstart_1200_battery_charger.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cdf3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCDF3 5332 bytes
SHA-256: f078b169ff1904aac3e76b7a1ca8a13e57717c490f8613def0b7dbad8ce0c78b
font_01_sfnt_off0000dff2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDFF2 6220 bytes
SHA-256: be13d512fadb08fae17b4e5f3fc35c3a97ae0f28d36eb4591342505c320f9bc2
font_02_sfnt_off0000f5da.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF5DA 11172 bytes
SHA-256: ca809043784c38e274f440f41d7a5a13a1b8b900c12d2bd8968c465d44f6aed7
font_03_sfnt_off00011c4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C4E 16340 bytes
SHA-256: d8f014fce173605e85d9d811c50121a6fa01ddc5eae299f86799fbf47d481436
font_04_sfnt_off00013212.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13212 4324 bytes
SHA-256: ce7e2e230a41ba6fc2d7d2240890c8289d67876d84a3d076d67c0b48111c8230
font_05_sfnt_off00013fc5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13FC5 1736 bytes
SHA-256: f27f1dab863be407bc80ce69f069aaa000ada345c50a5fba1d6b915b5f603bb6

Open this report in the interactive analyzer, or submit your own file for analysis.