Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a85a44873bfe49c…

MALICIOUS

PDF

78.1 KB Created: 2020-12-17 16:08:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-02
MD5: 4ab4da55a91790beb138889008f33c31 SHA-1: ea8554ea1f200133212d9f418059c9ef2444ae5a SHA-256: 1a85a44873bfe49c19d62e3ed1018515a6ed8ecc8ee22a0e16f968f32969e54c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL `https://trafffe.ru/aws?utm_term=dunnes+stores+cot+sheets` suggests a phishing or credential harvesting attempt, impersonating a known retailer. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs point towards an attack pattern involving user interaction with a malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/aws?utm_term=dunnes+stores+cot+sheets PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4501503/normal_5fad5a2cd5cab.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4376870/normal_5f8bc5a386148.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412897/normal_5f99f34e666a9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481280/normal_5fc5411873f25.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421970/normal_5fd1c63349e51.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4392871/normal_5fc5005ec3bc4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dofufiri/72500646676.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d68f93ab-586f-4013-bc16-37e614f5da39/lfs_z28_s2_keygen_indir.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/56a9946d-8416-4930-bc27-e55fd8813f84/rikedoxipigujukurilegilok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3dc8ff6a-231a-46dc-8298-caad46a6a97d/china_slim_tea_target.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a606e275-7b7d-4b17-92ad-44e03d33b389/tomodachi_life_personality_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ba16c1d3-39ed-4fe2-9f2d-15c422a57313/xabeju.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f5623e9-7e9e-459c-a3e5-9bd569575ab8/infiniti_middle_school_website.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/955a31cc-a9e2-498c-8e52-7eb296197c07/27871698967.pdfIn PDF document text
    • https://s3.amazonaws.com/memul/99161235038.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c334.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC334 16868 bytes
SHA-256: af4f92269eeeaa16dfbc9ef7a76627da004f91c3331dc24919ce821db0f04623
font_01_sfnt_off0000f584.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF584 4644 bytes
SHA-256: 887d6b2d28446e30d082169a0af3417b5bb66a476945c46fa29748ab1f9568d9
font_02_sfnt_off00010550.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10550 11180 bytes
SHA-256: 45f76537e535e71fbc79dc0ea426b052f43a119531096495b6befde7518746d8

Open this report in the interactive analyzer, or submit your own file for analysis.