Malicious PDF — malware analysis report

Static analysis result for SHA-256 03fedecf8d3eee9b…

MALICIOUS

PDF

76.9 KB Created: 2021-01-03 02:58:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 554219ba8440d9d211ca2ada10f91efc SHA-1: 20be9ccd53be435247e1247a6588407473dde3b0 SHA-256: 03fedecf8d3eee9beaaa52c75682fa8c38f587ce803c28e0ec8ae9b57bfd5831
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating it's a phishing trojan. It contains an embedded URL pointing to 'trafffi.ru', which is likely used to deliver a malicious payload or redirect users to a phishing site. The document body, though heavily obfuscated, suggests a lure related to a 'projector screen size guide'. No scripts were extracted, but the presence of an external URI and the overall detection profile strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=home+theater+projector+screen+size+guide PDF link annotation
    • https://cdn.sqhk.co/tasokuxu/hhahfgg/get_free_stuff_online_no_surveys.pdfIn PDF document text
    • https://cdn.sqhk.co/guxuboru/KZjjjgb/rutan.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420917/normal_5f9e3f7b68943.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/15680126-7a2a-4516-8142-7c53d56cf295/40158103908.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/91c5137c-f766-4569-af3e-139cf514cfbb/97041439758.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e69c2ed-4043-4ba2-91a5-9a10c5bfffe5/80394598972.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e831989f-7ca6-47f6-8f56-dd04fd045a52/49798399811.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d17f7e58-5b32-4157-bd77-5e47f5a74c5d/dfinition_relation_d_aide.pdfIn PDF document text
    • https://s3.amazonaws.com/vifusupegiza/ccna_guide_to_cisco_networking_fundamentals.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eed7bae3-d9fe-48d3-b988-c016b653ddc0/50596168885.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8ea4d6a0-a120-4a62-9f1a-f0a4d49a4322/97728052935.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e00d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE00D 5424 bytes
SHA-256: c67e00bd2269fb71bbb0535bc7f06eea8145e0e1ab4af549d2370015ebe15c9d
font_01_sfnt_off0000f25c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF25C 11284 bytes
SHA-256: d85175e18e67637c98ed213a6a37084e7ec949d9af8309564b0c99285740f0ac
font_02_sfnt_off00011864.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11864 4324 bytes
SHA-256: b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c

Open this report in the interactive analyzer, or submit your own file for analysis.