PDF malware analysis — malicious · 0130b2df5714502a

MALICIOUS

PDF

66.1 KB Created: 2020-12-18 18:08:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ba5466f58aa71c550559e7b5eba47699 SHA-1: 14de650ae5353c2a4867a58fa53d775465a70afc SHA-256: 0130b2df5714502a12f298b103d999e2eb31f3fa7dc2f54b30e17a392a253fb6

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by a ClamAV detection and an ML classifier. It contains an embedded URI pointing to 'trafftec.ru', which is likely a phishing or malware distribution domain. The PDF structure and embedded content suggest it is designed to trick the user into visiting this external URL, aligning with a spearphishing attachment attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/strik?utm_term=warm+water+fisheries+enhancement
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/kiwopusafize/national_geographic_scotland_travel_guide.pdf
- https://s3.amazonaws.com/leguvefu/nolibimorabazosek.pdf
- https://s3.amazonaws.com/vikukinumet/julekaxiwikujaganefetitip.pdf
- https://s3.amazonaws.com/wusigipufuvowix/89043301057.pdf
- https://uploads.strikinglycdn.com/files/a78c4532-b15b-4382-87c0-af6ca5a7331f/salopivo.pdf
- https://uploads.strikinglycdn.com/files/33f29528-5982-435c-b3bf-728528dda28c/37627439936.pdf
- https://static1.squarespace.com/static/5fc17af42e537a05ef0d3bea/t/5fc504729d793648402c127a/1606747250732/how_to_calculate_spell_save_dc_5e_paladin.pdf
- https://static1.squarespace.com/static/5fc1619768612547ed61873d/t/5fc306e5a97599144e5bea75/1606616808227/suny_poly_blackboard.pdf
- https://s3.amazonaws.com/tixeligufokup/attleborough_primary_school_uniform.pdf
- https://s3.amazonaws.com/tibanepoxilibud/tipos_de_argumentos.pdf
- https://s3.amazonaws.com/mefonevimimix/allerton_grange_new_uniform.pdf
- https://s3.amazonaws.com/lurutopobi/charminar_kannada_movie_song.pdf
- https://uploads.strikinglycdn.com/files/b664eb8b-cde4-4d74-9ba0-f7eff5203f82/whealan_pool_aquatic_center_chicago_il_60646.pdf
- https://uploads.strikinglycdn.com/files/f0b34549-07e2-435d-b7c9-3de7f38960c6/rizalififogividerotijusal.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c664.bin` `46bb6d814050f31b6bf26f76d49f441169d4dfe4b7864215675b75e6905ffed8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC664	5196 bytes
`font_01_sfnt_off0000d7ff.bin` `e3130047f1c275e1a7ab086a425da1b11ba1b05dfa9b3c26d798e99e626a7611`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD7FF	10396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.