Malicious PDF — malware analysis report

Static analysis result for SHA-256 efcf3a6f9628a6ff…

MALICIOUS

PDF

98.5 KB Created: 2021-01-17 09:14:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 87c512d758b6c4dd18daf9a43e5c6652 SHA-1: 1f353c65c2be7666e086574d18f3a2d298fbda62 SHA-256: efcf3a6f9628a6ffeefbb5178c206a4ec0fe7f850c3628edcac4183ffec8a49e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, with heuristics indicating an embedded external URI. The PDF contains obfuscated content and an embedded URL pointing to 'https://traffset.ru/123?utm_term=alttp+entrance+randomizer+tracker', suggesting a phishing or malware distribution attempt. No scripts were extracted, but the PDF structure and embedded URI are strong indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=alttp+entrance+randomizer+tracker PDF link annotation
    • https://site-1201036.mozfiles.com/files/1201036/sputnik_v_vaccine_update_in_russia.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4373016/normal_5fe5facf5cbd5.pdfIn PDF document text
    • https://cdn.sqhk.co/kemomonil/jdznjjO/sanitarium_lyrics_traducida.pdfIn PDF document text
    • https://site-1167971.mozfiles.com/files/1167971/3d_water_slide_games_online.pdfIn PDF document text
    • https://site-1172123.mozfiles.com/files/1172123/sandeep_maheshwari_age_2020.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4384655/normal_5ff01224680fe.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446776/normal_5fffa4d0d8a84.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4500911/normal_5fb77ca48de75.pdfIn PDF document text
    • https://cdn.sqhk.co/lufelumad/2jj9fie/95474127088.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4379048/normal_6003a4bf93aef.pdfIn PDF document text
    • https://site-1171749.mozfiles.com/files/1171749/rushcard_corporate_phone_number.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/rudelazifizuvo/dhtml_ka_full_form.pdfIn PDF document text
    • https://s3.amazonaws.com/fulosobezur/active_and_passive_voice_practice_worksheet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000130bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x130BF 5144 bytes
SHA-256: ea4926af2d0b052b5004bee61608e8276efd57784575b5e0db0a4a594aa143b4
font_01_sfnt_off00014231.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14231 10860 bytes
SHA-256: 927ae7b004370059cdbae7a919ffe8697f7c58b7e3432628c6e9ba0f6b535d1f
font_02_sfnt_off0001678f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1678F 16232 bytes
SHA-256: e1fcaa290bc8b5aed85f312864440120c61db6abd2add9737883d56687aaee62

Open this report in the interactive analyzer, or submit your own file for analysis.