Malicious PDF — malware analysis report

Static analysis result for SHA-256 217ba724ed3a80f5…

MALICIOUS

PDF

70.4 KB Created: 2020-11-12 17:31:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 0bb4ba2784a96253889c4e8cc1b4ee60 SHA-1: b851659c4f3463357cac8d08cd5bb0e4ed612f25 SHA-256: 217ba724ed3a80f588bfdc5acfa459a3cc130923c4462e703ebf4863860142a9
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'trafffe.ru', which is a strong indicator of a phishing or malware distribution attempt. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of the malicious URL is sufficient evidence for the attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/strik?utm_term=ark+grotte+the+island PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4385422/normal_5f9d8dab87f9d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408704/normal_5f93b882d7ffa.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kavitokolezub/to_be_past_tense_exercises.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/41f8bfb2-70d7-4a73-b23c-b5e9fe290bd1/webavajowiwa.pdfIn PDF document text
    • https://s3.amazonaws.com/faluzotixupi/nodosijodokipuvodurabefor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2736147b-5a21-4228-8054-a10d64553de9/numerator_and_denominator_super_teacher_worksheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/444e7cde-5bab-4e11-bfb3-644090d459aa/could_not_complete_your_request_because_the_smart_object_is_not_directly_editable._photoshop.pdfIn PDF document text
    • https://s3.amazonaws.com/sowewazulejewi/venozadijinobowopamako.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/006606e6-a369-4ea8-93be-6a69d2f533cd/37222753949.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2db4236b-4359-4133-a2bd-213c5aa67b16/56953117285.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/quantitative_approaches_to_management_levin.pdfIn PDF document text
    • https://s3.amazonaws.com/zemigiduwagafu/56000054708.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/95cceda1-f3a2-41fb-9858-3d5626e4f055/83889388487.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d5a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD5A0 5140 bytes
SHA-256: 8006c4390b26292a46b78427b0af2cbefb461a0d424a5ab1aa24b9da4ce13ccb
font_01_sfnt_off0000e71d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE71D 11536 bytes
SHA-256: 5bfcc98cdab1de1f148af5792fedf9de0042a7e08818a0809a436f9e7c6b5362

Open this report in the interactive analyzer, or submit your own file for analysis.