Malicious PDF — malware analysis report

Static analysis result for SHA-256 511ecedb7c97aedc…

MALICIOUS

PDF

65.3 KB Created: 2020-12-21 13:35:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 03deafda16cd0e5a449adc03024e0c65 SHA-1: 5de22759c04e091418c0f62e5535691545c55a66 SHA-256: 511ecedb7c97aedcd9579f874c3a7f0246581b2188d7a451f275af759c0e86c2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'trafftec.ru', which is likely part of a phishing or redirection scheme. The document body, though heavily obfuscated, suggests a lure related to product sales, consistent with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/123?utm_term=shoe+heel+pads+for+blisters
    • https://jamuseramomuf.weebly.com/uploads/1/3/1/8/131871426/zabajufu-femudana.pdf
    • https://zilowefid.weebly.com/uploads/1/3/4/5/134510497/vabiz_kexinijipobotu.pdf
    • https://ralikinu.weebly.com/uploads/1/3/4/8/134883141/nopasuxoravoki.pdf
    • https://movireralu.weebly.com/uploads/1/3/4/8/134879142/8f2e5e3fb0.pdf
    • https://ratanamiwul.weebly.com/uploads/1/3/4/3/134327333/sixajavad.pdf
    • https://rukagevilatixa.weebly.com/uploads/1/3/1/6/131608017/muwumiwifaja.pdf
    • https://jimagofer.weebly.com/uploads/1/3/0/8/130813953/katuram.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e6a9a89b-ea75-4324-bad8-8ffe058e417f/36175898085.pdf
    • https://uploads.strikinglycdn.com/files/ac341703-5bc4-4123-be86-ed41a8ac80b8/javiduwube.pdf
    • https://uploads.strikinglycdn.com/files/9dc95bb8-91a3-417f-854c-36ad3d422f24/kerilozim.pdf
    • https://uploads.strikinglycdn.com/files/5ae43f29-d9cf-492f-bd46-379e096fcab6/nice_words_that_begin_with_the_letter_r.pdf
    • https://uploads.strikinglycdn.com/files/078c6524-9e6d-4630-bcdb-6ba898199d3e/lokojaxe.pdf
    • https://static1.squarespace.com/static/5fc2f8256b97992eb5696e44/t/5fd20ffe7cf94534dc624114/1607602174752/chess_set_wooden_for_sale.pdf
    • https://uploads.strikinglycdn.com/files/aeb4607a-e7b6-41e1-809b-f8b4ce8effd3/13243282365.pdf
    • https://uploads.strikinglycdn.com/files/db933eb1-e784-4768-92c7-76b3b1b3efef/aptitude_questions_for_infosys_with_answers.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c177.bin
f2e86fe613e10a9132d7cf5b41b264b7824bb5d09c2768e7fd893065a2ff3c55
pdf-font-stream PDF embedded font (sfnt) at offset 0xC177 5372 bytes
font_01_sfnt_off0000d3aa.bin
8424d234f0c881d6135342fc48ba51bb7cd6d56606c2a61edc04b4e22f5f4f77
pdf-font-stream PDF embedded font (sfnt) at offset 0xD3AA 10912 bytes