Malicious PDF — malware analysis report

Static analysis result for SHA-256 3bdd80f6efd064d3…

MALICIOUS

PDF

99.3 KB Created: 2020-11-13 19:05:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b5dc8ca28b714b3dbe19409ac2b5f422 SHA-1: 1797a2452650270d2663f101190ddb8a3ef3ec31 SHA-256: 3bdd80f6efd064d3dd1ae4d1693a327ced9b1d2d7e2171fd5d45658645a52137
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document contains an embedded URI pointing to 'trafffe.ru', which is likely a phishing or malware distribution site. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious resource, consistent with spearphishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/123?utm_term=poetry+for+soldiers+in+urdu
    • https://cdn-cms.f-static.net/uploads/4368763/normal_5f94833dd9f92.pdf
    • https://cdn-cms.f-static.net/uploads/4470231/normal_5fad67c44d5bd.pdf
    • https://cdn-cms.f-static.net/uploads/4410186/normal_5f988e242813f.pdf
    • https://cdn-cms.f-static.net/uploads/4424007/normal_5f9f29053278b.pdf
    • https://cdn-cms.f-static.net/uploads/4366655/normal_5f9861d67b2d5.pdf
    • https://cdn-cms.f-static.net/uploads/4455669/normal_5fa7ab68a4573.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://fedorahosted.org/lohit
    • https://uploads.strikinglycdn.com/files/e9bd4ad5-35ac-4395-bc88-a62cf190b157/valig.pdf
    • https://uploads.strikinglycdn.com/files/55a98ca5-6f31-4e76-add5-ede877cc6638/68045635727.pdf
    • https://uploads.strikinglycdn.com/files/76e87e83-02a8-456c-aedc-47a52d578cf4/polaris_telescope_model_114eq_d.pdf
    • https://uploads.strikinglycdn.com/files/ef757147-8e44-48cb-91a7-7faa1faf4c56/81304998834.pdf
    • https://uploads.strikinglycdn.com/files/1ab3ce0d-d9d6-472c-8c21-005a7d5724f9/67640396706.pdf
    • https://uploads.strikinglycdn.com/files/f2f6e4ca-9041-41fd-9cf6-85b18633544c/14935497566.pdf
    • https://s3.amazonaws.com/vazisi/khaike_paan_banaras_wala_dj_songs.pdf
    • https://uploads.strikinglycdn.com/files/1667b314-314a-4cf3-b330-41718792fbef/zasixixakos.pdf
    • https://s3.amazonaws.com/livivuvuwugeb/89405550952.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00014430.bin
38a657dd5307ac3329602fc6a8c7f5f22cbca228c74e3565be1e34a91163efd2		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x14430 23396 bytes
font_00_sfnt_off000101da.bin
9871a3a66d7abec2fb4daeb64f6883e2218277c574604be4ca3596078e14cccd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x101DA 2896 bytes
font_01_sfnt_off00010c27.bin
636fdeee94158d68603155a6694749a268fe763ba48c38c8bc59c777cb701b9c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C27 4796 bytes
font_02_sfnt_off00011c91.bin
a5e81a65d6fe00527e34052c895a0b16a1510fcd5bdbd53a95e70f20487ee8fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11C91 12428 bytes
font_04_sfnt_off00016d9a.bin
58d9bd822ef7cba2ad8b98e0bc366949739ec166637b5ead81c572ee7b2401f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16D9A 4792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.