Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9905a6573957025…

MALICIOUS

PDF

118.3 KB Created: 2020-12-24 18:30:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: bc1024d68feba9460ca914c30b61c8fa SHA-1: 562d090c5492463480206be563ea1e5b272ea2d7 SHA-256: e9905a6573957025967352f8a2a5782132b051d0d31e62591eae5b86cddd0123
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, specifically 'https://traffset.ru/strik?utm_term=hypnotic+pulsator+lucid+dreaming+live+wallpaper'. This URL is likely part of a phishing or malware distribution scheme, disguised as a download for a live wallpaper. The ML classifier and ClamAV detection strongly support its malicious nature. No scripts were extracted, but the presence of the malicious URL is sufficient evidence for a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=hypnotic+pulsator+lucid+dreaming+live+wallpaper PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4479906/normal_5fafec6356773.pdfIn PDF document text
    • https://cdn.sqhk.co/jesisuvov/bukja9j/pexels_api_documentation.pdfIn PDF document text
    • https://cdn.sqhk.co/linerutinew/heiexeT/99870705240.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379842/normal_5fd5fb6c89a7c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376374/normal_5fc11e9cbf6ab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422622/normal_5f977fb09a047.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5271907-85f5-4f65-a095-8ae7d7f1ed26/99312008647.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bc5021f8-ed1a-4344-b093-2d4a8f51dae8/vafegu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/707a7352-3a45-493e-aa0b-3abf806feb5c/kyocera_solar_panels_for_caravans.pdfIn PDF document text
    • https://s3.amazonaws.com/dudigonifu/recurring_checklist_app_android.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/45c48af6-9526-4951-a7fb-a4e0625c8451/norosaloriva.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/499a7f62-ac42-44f7-8929-2c2e4d8900b0/iwata_airbrush_cleaning_kit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91a27995-6cd4-4180-ac6d-98f978339d06/refiwexenoseb.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/47255b1a-7cb1-4b40-b021-b9d5a8ab6549/free_reiki_attunement_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000112ae.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x112AE 25008 bytes
SHA-256: 02c003cd93b69a914aacfe030a81cb7a2f7aee37d25c4743740a37c22370ca00
font_01_sfnt_off0001605d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1605D 5608 bytes
SHA-256: d0e032fc4f877fd168c1d83d08bfe2539ef8585fed2b9d4aaa51083deafef955
font_02_sfnt_off0001736d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1736D 3328 bytes
SHA-256: f670942cad3ea4b35559a079523175d4f86be8586e5163063381022c397f32f9
font_03_sfnt_off000180e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x180E7 14636 bytes
SHA-256: 7079fd7ddbf160bba2339a53d32d7e621489d134bf1d8c77464aef2791aa53ec
font_04_sfnt_off0001ad93.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AD93 18472 bytes
SHA-256: cbe07ebf12c1817995b47951c5103e5a5d7f318790c36b01f3d0ae9fb4ea2c96

Open this report in the interactive analyzer, or submit your own file for analysis.