Malicious PDF — malware analysis report

Static analysis result for SHA-256 2bb86a3e46c13a95…

MALICIOUS

PDF

165.7 KB Created: 2020-11-11 16:18:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 16e8b2b6914917962fa51099aafbadb7 SHA-1: 15966467dadbf317728938cbd14016e50f6b565b SHA-256: 2bb86a3e46c13a95e3dd53568d105293e6b935c74503aa7bb60e98d9fc35bb50
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'trafffe.ru' suggests a phishing or credential harvesting attempt. Although no scripts were explicitly extracted, the PDF structure and heuristic firings point towards a malicious document designed to redirect users to a potentially harmful website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=844-208-4300%253D-3664+is+true PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4369935/normal_5f98afdb3ed13.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481289/normal_5fa6b6a6008ef.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426679/normal_5f98002deafdf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370286/normal_5f89d3b993b77.pdfIn PDF document text
    • https://lolipakefupixo.weebly.com/uploads/1/3/4/6/134614949/d27400f352afc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457563/normal_5fa69e7f2052d.pdfIn PDF document text
    • https://wedebiki.weebly.com/uploads/1/3/0/9/130969436/safoduxadotijisomi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4415544/normal_5f97e03ae231a.pdfIn PDF document text
    • https://dedotomonifagax.weebly.com/uploads/1/3/1/6/131606429/2385817.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410985/normal_5fa1f4eada373.pdfIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/gewisetug/jidafiwu.pdfIn PDF document text
    • https://s3.amazonaws.com/pazovugal/35259322861.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00021bab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21BAB 1528 bytes
SHA-256: 64d53b4318ba7dc869bcefe2c6c56431e6e12bcaf96a32242cfa9e17b755ba3b
font_01_sfnt_off00022373.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22373 5292 bytes
SHA-256: 828c5cb132d50cd38f970dc3e8b3dad9795bc9cc188b747ed0f152fdf06696fa
font_02_sfnt_off0002358d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2358D 1800 bytes
SHA-256: a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620
font_03_sfnt_off00023e1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x23E1A 21108 bytes
SHA-256: bd9ceb8a9de867121954c7f703833f086345bf8852d876eb6e2324bd87e87494
font_04_sfnt_off00027336.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27336 16164 bytes
SHA-256: f469c5aa689aa4c1965481b78cfaebbf1c3ebdad2306c7067134b7b4aaa0addd

Open this report in the interactive analyzer, or submit your own file for analysis.