Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a4275c71e3bad71…

MALICIOUS

PDF

69.6 KB Created: 2021-01-12 15:21:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 23cf9f8e9fefb244fbd418fd9c0ed8ba SHA-1: bd8027afeb8c5adbd19cbcc598febffd87ce4188 SHA-256: 2a4275c71e3bad71a24303046a26dc678f6cbcd0a083920a811f5794889cd44e
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV as Pdf.Phishing.Trojan. It contains an embedded URI pointing to 'trafftec.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, and the presence of embedded URLs indicates an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7994

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?utm_term=black+clover+asta+demon+form+episode PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4379035/normal_5fba2e0576104.pdfIn PDF document text
    • https://cdn.sqhk.co/wekonexiw/jfsMINw/53006727541.pdfIn PDF document text
    • https://cdn.sqhk.co/fejavegiwo/uUWijji/gta_v_zombie_apocalypse_mod_xbox_one.pdfIn PDF document text
    • https://site-1175555.mozfiles.com/files/1175555/68263971816.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4458824/normal_5fa38ccd1620c.pdfIn PDF document text
    • https://cdn.sqhk.co/vatopibar/gevfIhj/caregivers_home_health_services.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385216/normal_5fa0ba11b0869.pdfIn PDF document text
    • https://site-1171458.mozfiles.com/files/1171458/femoreleropazobataras.pdfIn PDF document text
    • https://site-1180109.mozfiles.com/files/1180109/roteruzo.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xalexojaxipud/nike_sb_dunk_low_size_guide.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ecc1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xECC1 4164 bytes
SHA-256: 79bd1fddb648ffd6086b3f28f2f9671a603501f26315dd9529f80ff963e5cbcf
font_01_sfnt_off0000fb7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB7B 5472 bytes
SHA-256: 92b2bb7a103cc517b0bc82c0b148026403a22eebf68f8d683372a957ffadadc4

Open this report in the interactive analyzer, or submit your own file for analysis.