Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f0959bff257e0a5…

MALICIOUS

PDF

99.9 KB Created: 2020-12-02 11:47:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3e5e497ad559d97ee6208db96979ea23 SHA-1: 91fe29a10f76b2b646aa87856316d13c0f948e18 SHA-256: 6f0959bff257e0a505ad300b92e1a5ef40e9f0a012f6ff072de75635afd2cb53
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing a lure related to a 'Gina Wilson 2015 answer key geometry'. It includes an external URI pointing to 'traffine.ru', which is flagged as suspicious. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffine.ru/strik?utm_term=gina+wilson+2015+answer+key+geometry
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/meludav/pathfinder_kingmaker_modding_guide.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe111a5147b14804fa91ae/1606291739485/yahoo_email_recovery_password.pdf
    • https://s3.amazonaws.com/juzowilipi/how_to_cite_a_quote_in_mla_style.pdf
    • https://s3.amazonaws.com/saxefi/maxemolewapises.pdf
    • https://static1.squarespace.com/static/5fc10b71bdb33045eec31c8e/t/5fc55f829b1ed0353890d2a3/1606770562633/love_story_lyrics_karaoke.pdf
    • https://static1.squarespace.com/static/5fc0ecedbf71053ccb1052a5/t/5fc119763485235c86edbbc0/1606490488442/risixunoz.pdf
    • https://static1.squarespace.com/static/5fc0be4612facd59ceac2d5b/t/5fc35d6d9d79364840f8ba1d/1606638958319/kojomotawipudewama.pdf
    • https://s3.amazonaws.com/loneminovu/xugisizaligifakogeganomo.pdf
    • https://s3.amazonaws.com/pazifetanegapu/88466501301.pdf
    • https://s3.amazonaws.com/jeromopelurab/codename_villanelle.pdf
    • https://s3.amazonaws.com/jowutoneranemuk/8372395166.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe723df3de5e49b536e566/1606316606290/nosuniket.pdf
    • https://static1.squarespace.com/static/5fc0d4752bbd7406580625ec/t/5fc241b7173fb5383becebc0/1606566329604/99519122513.pdf
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe25eaa97599144ec11856/1606297068371/72109975123.pdf
    • https://s3.amazonaws.com/ninasivol/newatutojapo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013eda.bin
5b389ca6156f9518597e617823415b6a20702f61585c932ddaa870f028496e61		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13EDA 5532 bytes
font_01_sfnt_off000151b2.bin
d68f92cd07dc00616f46b50fd310a3cd6e91a37460b41126393429cfbb4ba0cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x151B2 10296 bytes
font_02_sfnt_off000174a0.bin
4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x174A0 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.