Malicious PDF — malware analysis report

Static analysis result for SHA-256 313254d64c9d303d…

MALICIOUS

PDF

88.5 KB Created: 2020-12-30 15:32:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 200ea21a6cc197e858a5fbf32aa6f5f4 SHA-1: de1f12f39b3415edd0facad588e2817d4229d351 SHA-256: 313254d64c9d303da7639454dc21f8670d589c19d65a32938b13255137cf8223
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'trafffi.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, contains references to 'The quantum thief wiki' and 'wkhtmltopdf', suggesting a potential lure or exploit context.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/123?utm_term=the+quantum+thief+wiki PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4414871/normal_5fd9dba8408fd.pdfIn PDF document text
    • https://cdn.sqhk.co/zofagopipowi/bHmkjdZ/mabiligonoxi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470533/normal_5fd3d4c5d697a.pdfIn PDF document text
    • https://cdn.sqhk.co/bujavenizake/geAc2ji/kugilamakofujetijeduvetin.pdfIn PDF document text
    • https://cdn.sqhk.co/momujolo/7BlNgiF/download_game_dev_tycoon_mod_money.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384655/normal_5f9073db57bda.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425255/normal_5fcc92e21ecb2.pdfIn PDF document text
    • https://cdn.sqhk.co/pujapipiwat/gOji7Md/gesogedezagepakesiviruz.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4495262/normal_5fe077869625a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367650/normal_5f8d2f42c2db7.pdfIn PDF document text
    • https://cdn.sqhk.co/netimawifes/Vghhevw/60560298383.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369150/normal_5fbc2cee0da39.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367925/normal_5f8df99686a9a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4484805/normal_5fae09676c811.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfbcdea5-5a9f-4fa4-811c-828a6239cb94/skyrim_fire_and_ice_overhaul.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2438976a-767a-4453-8403-a9332be8f96b/gosubulefopexinukemopag.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de02dfd2-3b1f-48aa-b1ad-93ec7ecb0cd4/suunto_elementum_terra_steel.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011fe6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11FE6 4932 bytes
SHA-256: c7a970d57ec1d8fdd5e44b0366749bd3647b98d5a3083de2d9a48e1bd3c883d2
font_01_sfnt_off000130a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x130A4 11224 bytes
SHA-256: 8fad15cacc0c23f0794f802666a2a4f3aa0d2c31b7301fec091e6695ffd3f1c6

Open this report in the interactive analyzer, or submit your own file for analysis.