Malicious PDF — malware analysis report

Static analysis result for SHA-256 3cb44adf7736e678…

MALICIOUS

PDF

69.8 KB Created: 2021-01-08 14:46:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-16
MD5: b3125933aac922cc5e7bd63ea3e67c35 SHA-1: 51732a99ad839bda3420e210ba8e3fb8bf5e9871 SHA-256: 3cb44adf7736e678a951b210b165b28a83a339e9a9a73b3eb3fc4ea33dae09f4
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'trafffe.ru', which is likely a phishing or malware distribution site, disguised as a wallpaper download. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and a date, suggesting it was generated programmatically.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/aws?utm_term=wallpaper+girl+for+android PDF link annotation
    • https://fekanefitogi.weebly.com/uploads/1/3/4/3/134340372/7776168.pdfIn PDF document text
    • https://julasunanuk.weebly.com/uploads/1/3/4/3/134308365/c8d94680b2807.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4383131/normal_5ff3bc013e67a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367621/normal_5f89219e150c9.pdfIn PDF document text
    • https://mojivimimujovo.weebly.com/uploads/1/3/0/8/130874437/vepulakanug.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/ropuba/apk_whatsapp_untuk_tablet_samsung.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/abff2554-96a7-482d-875c-7421c70cb127/tepakuruvifomiwuwofizus.pdfIn PDF document text
    • https://s3.amazonaws.com/gudukupir/innisfree_sheet_mask_review_malaysia.pdfIn PDF document text
    • https://s3.amazonaws.com/baposivarabuj/9264046867.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3f4b5a6e-5af4-44e1-9428-9456b748d96c/99025152414.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8415e1ff-5854-43cf-a0dc-1beeabb26946/clash_of_clans_cheats_really_work.pdfIn PDF document text
    • https://s3.amazonaws.com/jebupofedijakuk/37947633715.pdfIn PDF document text
    • https://s3.amazonaws.com/bifamomove/4171613021.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3eabb039-1add-4b1c-baf1-61e5c8bfa6d5/knowing_edgar_allan_poe_worksheet_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/posufij/sobesugonopajowivax.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae63e700-1e6b-4048-9f21-57754dc181fb/debir.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000be86.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBE86 5044 bytes
SHA-256: f7fdf500293e8c5a6018cb10b2e3dd51a075b7b210412c97cd2aecb25581315f
font_01_sfnt_off0000cfd2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCFD2 10624 bytes
SHA-256: 2768e0877a7a5a65f6f105d7f8dd79064202fa26e348fc9cb315e935c933cd92
font_02_sfnt_off0000f39b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF39B 16164 bytes
SHA-256: f469c5aa689aa4c1965481b78cfaebbf1c3ebdad2306c7067134b7b4aaa0addd

Open this report in the interactive analyzer, or submit your own file for analysis.