PDF malware analysis — malicious · 0005593c33e19cb0

MALICIOUS

PDF

58.6 KB Created: 2020-11-24 07:39:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e191cabb43fb8ef7acadef5fad920c86 SHA-1: 3c910297c75bc2e92015d857b3b88db28b3a70ee SHA-256: 0005593c33e19cb08051d92311069d3028c9afa584808a38b1bdaa1f6e2f8dd9

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'trafffi.ru', which is likely used to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a product lure, aligning with common phishing tactics.

Machine Learning

Nyx PDF Classifier malicious score 0.7439

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/aws?utm_term=focusrite+scarlett+2i2+usb+audio+interface
- https://cdn-cms.f-static.net/uploads/4412584/normal_5fa4d3b86f9e8.pdf
- https://kifenefaru.weebly.com/uploads/1/3/4/3/134327755/8319354.pdf
- https://cdn-cms.f-static.net/uploads/4367950/normal_5fa970a255618.pdf
- https://cdn-cms.f-static.net/uploads/4375073/normal_5f8a28e888470.pdf
- https://cdn-cms.f-static.net/uploads/4393901/normal_5f93b2bd0f252.pdf
- https://cdn-cms.f-static.net/uploads/4369788/normal_5f90db612b8ab.pdf
- https://digonowokeke.weebly.com/uploads/1/3/1/8/131856318/2210070.pdf
- https://cdn-cms.f-static.net/uploads/4368731/normal_5f88bcf861b78.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/fokapikow/bipolar_disorder_download.pdf
- https://uploads.strikinglycdn.com/files/f2a262a0-1c63-49a1-9897-7d4c764ff33f/47535727110.pdf
- https://uploads.strikinglycdn.com/files/091c79ad-d117-4188-a92b-8237935c3802/venirudosonudi.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c2b8.bin` `1d25ab46ffade72f1944a5e9e08a5cfa9a5ef822a8dc7d9862bb03e51e9e6112`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC2B8	5240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.