Malicious PDF — malware analysis report

Static analysis result for SHA-256 1580bb03c0362a3d…

MALICIOUS

PDF

123.1 KB Created: 2020-12-18 00:34:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: be17683f21aee5a2c0269f30c9d48146 SHA-1: 741cbc03e1b56376f4b10bc65aa4a8ac3ece1318 SHA-256: 1580bb03c0362a3d41eb2e484eb0ee3262e8d40bdc94ba5a3a9d6e7eb79a687f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as Pdf.Phishing.Trojan. It contains an embedded URI pointing to a suspicious domain, trafffe.ru. While no scripts were explicitly extracted, the nature of PDF malware often involves exploiting vulnerabilities or embedding malicious JavaScript to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=application+of+geometry+in+physics PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4500429/normal_5fd808f9488f5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452835/normal_5fdbd94660fe6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381104/normal_5fd14f18cb0c2.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc50bbc92c50b1a1e921daa/t/5fd0d77426d54b3c06dcd10a/1607522165520/98932813942.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aaa617a4-ec22-479d-9fc3-fd04636c6439/kokube.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf6da73299f0c543960d1/1606219483618/steering_wheel_wrap_near_me.pdfIn PDF document text
    • https://s3.amazonaws.com/duzexefemosaxe/can_can_free_sheet_music_piano.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f58c28bc-824d-47ae-930c-77c2e07cbd58/a101_cv_indir.pdfIn PDF document text
    • https://s3.amazonaws.com/vufupu/44508239990.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c1a7ae3f-1446-4594-b098-d7c931169dce/great_weapon_fighting_fantasy_grounds.pdfIn PDF document text
    • https://s3.amazonaws.com/xabalaru/49911102838.pdfIn PDF document text
    • https://s3.amazonaws.com/dukexajuj/characterization_worksheet_3_answer_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c1cbb3a3-0e1c-4129-bbea-485b0a512c14/at_the_cross_hillsong_chords_g.pdfIn PDF document text
    • https://s3.amazonaws.com/lopadivupudexa/cbse_grade_12_maths_textbook.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001847f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1847F 5520 bytes
SHA-256: 2585f280b17ce977cc009fda5965821d7c8ab20d3a90f6aec70a214e522e7f3e
font_01_sfnt_off0001972b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1972B 17020 bytes
SHA-256: 390811955ef1e54e02807e2a70736b594b10af59d15e5e1f9e49a4a19eca12a3
font_02_sfnt_off0001c79b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C79B 16148 bytes
SHA-256: 4d6819832c82b08b9ce7c706b5cb98ac46ced7cbb743301eca90489f0e3e1710

Open this report in the interactive analyzer, or submit your own file for analysis.