Malicious PDF — malware analysis report

Static analysis result for SHA-256 f603429720d520a4…

MALICIOUS

PDF

62.6 KB Created: 2020-12-15 05:52:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: a7c82189a121497812dd41126d87de7b SHA-1: ee0a5294c4decd4d776f577f3310e70782634564 SHA-256: f603429720d520a49a599d3b6bdceaab77cd5f6e2d9c0e4052219142f4131b7c
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded external URI pointing to 'traffset.ru', which is likely a malicious domain used for phishing or malware distribution. No scripts were extracted, but the presence of the malicious URL and the detection signatures strongly suggest a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/strik?utm_term=agptek+ha0021+manual PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4367007/normal_5f8743ab13b0c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369496/normal_5f994ac06c681.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd09efec0a1d2b4e576893/1606224368082/zogevaxobovepopinatedeki.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc55ba5239b0722914ef72f/t/5fc66d4f3c6ccf69f33c01bd/1606839635267/gavilililidugibevumexi.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc712e5c43b171198888532/t/5fc891f96031f47386234676/1606980090628/roblox_funny_videos_try_not_to_laugh_impossible.pdfIn PDF document text
    • https://s3.amazonaws.com/latufenaw/xubogerokup.pdfIn PDF document text
    • https://s3.amazonaws.com/tesotiwapax/super_smash_bros_melee_unlockables_gamecube.pdfIn PDF document text
    • https://s3.amazonaws.com/kiwopusafize/toy_defense_2_mod_apk.pdfIn PDF document text
    • https://s3.amazonaws.com/fukepez/advanced_call_center_software_free.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc65b470a2757459b08396c/t/5fccbf4933187724c4eebabe/1607253834434/soginafakadinixuvolak.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5bbff496-b4b6-454a-8382-a7c1ddec1abb/40866209215.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8a0f6c62-28b9-4a47-9156-d0012c632613/11th_standard_english_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/kewuxejikiwe/mtg_drafting_guide_eldraine.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b76e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB76E 5340 bytes
SHA-256: 3a47c26a3d56b245f54f2ca07e2d9a5a3ec12fa2602993c857204ca490313191
font_01_sfnt_off0000c981.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC981 10704 bytes
SHA-256: 79f42cfc5fa73f2cbcad225f417388e6be97bd2f778560ccadf93166146f9af9

Open this report in the interactive analyzer, or submit your own file for analysis.