Malicious PDF — malware analysis report

Static analysis result for SHA-256 57a753c435528352…

MALICIOUS

PDF

62.4 KB Created: 2020-12-17 04:04:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-27
MD5: a889cb46d2a47df92f14653282a3996b SHA-1: 9d2aca296fe086558b744307bd661738d2dbf1f7 SHA-256: 57a753c43552835204ece6d790d64ed394caaa669ec5d6373d01ccb72182dafe
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URI pointing to 'trafffi.ru', which is a strong indicator of malicious intent. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest it's designed to redirect users to a potentially harmful site, likely for phishing or to download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/strik?utm_term=central+dogma+and+genetic+medicine+biointeractive+answers PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4377697/normal_5fa3dc4b20c0d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366646/normal_5f8760db84288.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426063/normal_5fda8738a34a4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366628/normal_5f887b7aa334c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393035/normal_5f98e7ec18ea4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4423443/normal_5fa87676eb49f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4483586/normal_5fcc4906723c0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4449600/normal_5fd65c6e304c0.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wifukedot/10763262066.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/83a29b43-e50e-4c03-93fb-27bfdb10f7c1/skateboarding_made_simple_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/799c2f2e-998f-450e-900c-cadb51e28828/lenovo_y500_ideapad.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb0296dd-aa6a-494e-a999-9ce4ddd7c376/honda_hrv_hybrid.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b56fdded-c8f3-4cab-9706-3c4fd98a0a96/old_version_of_showbox_apk.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b090488-8657-4d10-a901-bcfea440a534/90043749980.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b68b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB68B 5456 bytes
SHA-256: 48382aa2bd35181c22076e4229adbf7d248455d4897832a93dd1273523854ab9
font_01_sfnt_off0000c90f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC90F 10460 bytes
SHA-256: d3424658d9f05b2db3012dbf8dc24046f2c15f689aa9edc35e8e7f5fe9668483

Open this report in the interactive analyzer, or submit your own file for analysis.