Malicious PDF — malware analysis report

Static analysis result for SHA-256 fade083ec88798ff…

MALICIOUS

PDF

72.7 KB Created: 2020-12-19 01:40:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 886f7afaede6e42b72832ad23a3cc238 SHA-1: 79bbdde19a3594bfdbe78e1250b3aac90d6d5332 SHA-256: fade083ec88798fff55446be70d0d2b27c7336736307ebfcd821b666b8811a4a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document body, though partially corrupted, suggests a lure related to a 'Waveshare 7 inch 1024x600 datasheet'. A critical heuristic identified an external URI pointing to 'https://traffnew.ru/aws?utm_term=waveshare+7+inch+1024x600+datasheet', which is likely the payload delivery URL. No scripts were extracted, but the PDF structure and embedded URI strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/aws?utm_term=waveshare+7+inch+1024x600+datasheet PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4427544/normal_5fc0cfbe1ade4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421970/normal_5fdb30690bade.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365586/normal_5f87f6639e5f8.pdfIn PDF document text
    • https://labopepiw.weebly.com/uploads/1/3/4/7/134747507/8007959.pdfIn PDF document text
    • https://dopakuxapat.weebly.com/uploads/1/3/4/8/134895633/9220618.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382965/normal_5f91d8ae34a1e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4417025/normal_5f99008387f06.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1b4feef3-34bf-4312-8e6d-bb1d4d98acaa/35183562305.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e508ca96-bcb1-4700-9904-d1371c1ff157/62923802337.pdfIn PDF document text
    • https://s3.amazonaws.com/zamuriza/xitidavaxofevuk.pdfIn PDF document text
    • https://s3.amazonaws.com/dobesogum/metetepav.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/924c29f5-f2e0-421c-a56f-b124ed4fd98e/sedipesujobiza.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f22a9f7d-7e2d-4cee-b03b-c7c8c143a35d/tolufugipuxijibeterezop.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcfbc48cb11b25c09bee00/1606220741198/4748660314.pdfIn PDF document text
    • https://s3.amazonaws.com/tokudapele/nejofefes.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc69b6fdf132613bbe520e9/t/5fc8dad090a4f8549d82da01/1606998737688/superhero_5k_run_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/pisik/goparerog.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf938a12-f89a-4aa2-8b69-b2773e642ec2/99630764442.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d861.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD861 5784 bytes
SHA-256: eb59832ab752de363b67a9b5c8cc33e4f9c65af8441fd0437947dddcd04f33a9
font_01_sfnt_off0000ec33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC33 11740 bytes
SHA-256: d5296afb45b651855acb78ef1f18c68a897f8bb9c73544391af99ea6f266114b

Open this report in the interactive analyzer, or submit your own file for analysis.