Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e0127391c5b9bbf…

MALICIOUS

PDF

101.6 KB Created: 2021-01-13 18:12:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1db785889c084a73224c2d8363d878c0 SHA-1: 469509f99618331f2011097142c947d5baf26827 SHA-256: 7e0127391c5b9bbf34b31ffdea73c371f09a67a3f7941f81834073eb9b70f044
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic flagging it as a PDF phishing trojan. An external URI pointing to 'trafffi.ru' was extracted, which is a strong indicator of malicious intent. The document body, though heavily obfuscated, contains metadata related to 'wkhtmltopdf' and a date, suggesting it might be a crafted lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8953

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=biugo+app++apk+android
    • https://cdn-cms.f-static.net/uploads/4394073/normal_5fd833818a664.pdf
    • https://site-1167986.mozfiles.com/files/1167986/the_archers_bbc_soap_opera.pdf
    • https://site-1083678.mozfiles.com/files/1083678/65654738502.pdf
    • https://cdn.sqhk.co/wevexifimur/cjjhgfl/jungle_animal_hair_salon_2_mod_apk.pdf
    • https://site-1173664.mozfiles.com/files/1173664/kiposenitinisinabanunel.pdf
    • https://cdn.sqhk.co/lafuwexale/WUoicDR/jesojaxotakonafadegonanur.pdf
    • https://cdn.sqhk.co/kujusiru/zggLahh/52425730904.pdf
    • https://cdn.sqhk.co/gafisasiwu/YEigj9p/offline_monster_battle_games_for_android.pdf
    • https://s3.amazonaws.com/bagisi/scotty_sire_what_s_going_on.pdf
    • https://s3.amazonaws.com/panokojol/lexepafejinodal.pdf
    • https://s3.amazonaws.com/xesigeze/gosijezozugonaw.pdf
    • https://s3.amazonaws.com/bikikanafopavu/rugujulezetederapubevugux.pdf
    • https://s3.amazonaws.com/pazerogasarinu/epileptiform_activity_autism.pdf
    • https://s3.amazonaws.com/vinejivunitego/pofekit.pdf
    • https://s3.amazonaws.com/fevobelijogal/neon_evangelion_piano_sheet_music.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.