Malicious PDF — malware analysis report

Static analysis result for SHA-256 f028fc66895e2e49…

MALICIOUS

PDF

57.7 KB Created: 2020-11-25 12:09:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c56a8ff272b5c2cace91ed12db7f5826 SHA-1: 7698c3d02d84384ee89e741e39d602fb4e101382 SHA-256: f028fc66895e2e49f44d0584153520f10c615737b1e30639f2e23c6db7ee1a0c
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical for phishing attacks. It contains a single external URI pointing to 'traffset.ru', which is flagged as unknown reputation. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect the user to a malicious site or download a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 57 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/123?utm_term=msp430+family+user+guide
    • https://cdn-cms.f-static.net/uploads/4382196/normal_5f9b310388fee.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/ef2ca3a0-a376-477b-8d00-cf450d0e46ce/55093101494.pdf
    • https://uploads.strikinglycdn.com/files/010ce77a-e253-4554-8f26-a01a1239947a/kemasuxovejawuridolowapev.pdf
    • https://s3.amazonaws.com/dorulusof/61832560199.pdf
    • https://uploads.strikinglycdn.com/files/d18d2358-5832-4e43-be82-bb81ae495b52/47507550297.pdf
    • https://s3.amazonaws.com/falufusu/video_converter_download_pc.pdf
    • https://uploads.strikinglycdn.com/files/06b45367-d4ef-4ca2-b017-c2505056921d/47996091547.pdf
    • https://uploads.strikinglycdn.com/files/4fb33662-618c-47cd-8bb1-33a3b19d4b1a/vigivoxemotojutuxosin.pdf
    • https://uploads.strikinglycdn.com/files/17df146a-7260-456b-a711-d9cdd6674729/la_puissance_de_votre_subconscient_gratuit.pdf
    • https://s3.amazonaws.com/doxifuba/36681418536.pdf
    • https://uploads.strikinglycdn.com/files/460e23e2-785a-4fbf-a4d0-9d781a0ea936/selda_bacan_ahmet_kaya_dostum_dostum.pdf
    • https://uploads.strikinglycdn.com/files/1c70b6d6-03d9-468c-ba8d-0b3aaae68244/34029924397.pdf
    • https://uploads.strikinglycdn.com/files/cc5ee9f9-9612-4e1f-99a1-0cbc8d93f62b/68746716550.pdf
    • https://uploads.strikinglycdn.com/files/166011cc-17aa-48c6-b23a-d923d1b1cc87/povefuruv.pdf
    • https://s3.amazonaws.com/wiwamoxamo/le_spleen_de_paris_english.pdf
    • https://uploads.strikinglycdn.com/files/f68b82cb-a0b9-4608-8ba6-4a7f347ca8c1/our_god_chords_micah_stampley.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000acf8.bin
f357883e041ccb653a9abe43228c267af88ec6552668bb59f26b819fb6904604		 pdf-font-stream PDF embedded font (sfnt) at offset 0xACF8 5860 bytes
font_01_sfnt_off0000c0f1.bin
a7987255feded63c201a44160c11348b99853084c6b5a6c69278948add451443		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC0F1 7644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.