Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b5b35981f8951db…

MALICIOUS

PDF

77.9 KB Created: 2020-12-01 19:41:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-24
MD5: 08ffcb320e2fd231e79b4bf823adcd81 SHA-1: ef95dfb5dd47d63cde39ace81ab5734ae6147a7c SHA-256: 2b5b35981f8951db1de7c176217c19bfba13c4f0e916f848186e82d09b4909eb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. An external URI pointing to 'trafffi.ru' was extracted, suggesting the document's purpose is to redirect users to a potentially harmful site. The document body contains garbled text, but the presence of the URL and the overall detection strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/123?utm_term=katz+und+maus+simon+beckett PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4382961/normal_5f8ffd5b2288e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367617/normal_5f9a6b32d1c7f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380881/normal_5f93f2a45f31f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/kijelopazekune/parking_at_toms_river_park_and_ride.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf9d073299f0c5439c0f2/1606220241371/49903421187.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0805cd49dd12447321748/t/5fc259871972c46e3ceaa7f5/1606572426074/kukuxevulumi.pdfIn PDF document text
    • https://s3.amazonaws.com/wujapu/gd_em_c.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe4e87145a8629dc7e4174/1606307467285/16898786524.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0bfaa8787e879896b3d28/t/5fc153d17acac6192af23768/1606505425693/baltimore_county_fire_rescue_academy.pdfIn PDF document text
    • https://s3.amazonaws.com/zirojopemup/acog_2013_hypertension_in_pregnancy.pdfIn PDF document text
    • https://s3.amazonaws.com/wuniku/vonuritava.pdfIn PDF document text
    • https://s3.amazonaws.com/pajeriramal/tivomi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dbb1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDBB1 5180 bytes
SHA-256: 0dcfead278c4b0cbd483aa174dde2d17cd457a0a7194292af6eeb61644bebb28
font_01_sfnt_off0000ed4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED4F 11944 bytes
SHA-256: 390a29c6cbb5348e73341f08dac98ad5cfb6baffe5591edd967bb1be89362124
font_02_sfnt_off00011458.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11458 16092 bytes
SHA-256: 9af6fc3bf9d751f70540aea0fa47faa159a3604992cda23d2adcda3ffc5346b2

Open this report in the interactive analyzer, or submit your own file for analysis.