Malicious PDF — malware analysis report

Static analysis result for SHA-256 ecf870e1e8849186…

MALICIOUS

PDF

124.2 KB Created: 2020-12-06 00:03:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 910eceaf7f7ea349e3d7e09e7d5ab211 SHA-1: d21dea98bb3b72cb92386e7c87320717e3673bb4 SHA-256: ecf870e1e8849186c04a0ace5b97c8cc72a62db7479274fb04ba19704cf3d735
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.007 JavaScript

The sample is a PDF file flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. Heuristics indicate it uses brand impersonation (Microsoft) and presents a fake download button to lure the user. The primary malicious indicator is the embedded URL `https://traffset.ru/aws?utm_term=arya+2+telugu+songs+free++doregama`, which does not match the impersonated brand and is likely used to deliver a secondary payload or steal credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 8

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://traffset.ru/aws?utm_term=arya+2+telugu+songs+free++doregama.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/aws?utm_term=arya+2+telugu+songs+free++doregama PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4378831/normal_5f8b14885ad04.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477916/normal_5fadfa43bdf80.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4372737/normal_5fac3c6980eff.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/felasorarabipis/business_proposal_writing_sample.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc34e1bf9866f3fd2e3a1df/t/5fc60febbc819f1cf4a8364c/1606815724051/7436896153.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc548af9955c744b5585162/t/5fc7d1712431962c2dc393f5/1606930801300/scrap_copper_prices_near_me.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc53768bf71053ccb2bf618/t/5fcbf4f9662d5e24e08b8896/1607202042840/37675299200.pdfIn PDF document text
    • https://s3.amazonaws.com/dejazuvorira/android_magnet_software_for_pc.pdfIn PDF document text
    • https://s3.amazonaws.com/sakaburepagase/aurora_4x_game.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe2d8e3c02f22b9dd78a2b/1606299022775/chrystal_christmas_ornaments.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc11a296b97992eb55d442c/t/5fc4adcd9ee0f32b87e7fbf5/1606725070680/zewutenudagikabazaboduri.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a984.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A984 5452 bytes
SHA-256: 9852c60b481b1e114d776f09221fd49ae4afc7bd8554e1389b0d38fa2fb04663
font_01_sfnt_off0001bc01.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1BC01 11892 bytes
SHA-256: 2a396c6c80d5fdc657c1f1c71a97ebfb3852f585f8fd498c207d8eb9e4fccaf7

Open this report in the interactive analyzer, or submit your own file for analysis.