Malicious PDF — malware analysis report

Static analysis result for SHA-256 847169c4e7772ac2…

MALICIOUS

PDF

133.9 KB Created: 2020-12-19 18:21:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 2b46776311228eaf9dba86d3055d4023 SHA-1: 732202dbd1192615de1f29cad59d9dca873683ac SHA-256: 847169c4e7772ac20fb7bcd8450195bf7c8bfb589f8eace59bc18bb18633ac40
66 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, trafftec.ru. The ClamAV heuristic also flags it as Pdf.Phishing.Trojan. The document body, though heavily obfuscated, suggests a lure related to "Wingdings alphabet pdf", likely intended to trick users into visiting the malicious URL. No scripts were extracted, but the presence of an external URI and the phishing detection suggest a social engineering attack.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3257

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafftec.ru/aws?utm_term=wingdings+alphabet+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4377400/normal_5fbf18d69bb68.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4413002/normal_5fcb57f2cad27.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380079/normal_5f96625711947.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369762/normal_5f8bec0b14d59.pdfIn PDF document text
    • https://s3.amazonaws.com/jafujasiwetid/baystate_reference_labs_east_longmeadow.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf518e61e25426e12f4b70/1606373775314/namivetajivonogomuxugola.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5924d051-bbf1-48d3-b2ff-d915e2a9e6c5/vunarolivuxerubor.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d432de9b-9fef-4396-a0ac-debda629f214/wazunabujok.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEE22 7044 bytes
SHA-256: b5ff9972eeb34355c3e8aa5279d5096e071d8e2e568cfa43681059bb1c40151e
font_01_sfnt_off00010006.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10006 3036 bytes
SHA-256: efeee12010c59c0d2c0742bffedd9ed82e6d6de0c82a841046fc411362ae50d4
font_02_sfnt_off00010acf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10ACF 5360 bytes
SHA-256: 0438cc4f2dc9d82c3793e64342f281a96d125f6e289b04adc86e066afe267956
font_03_sfnt_off00011cd7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11CD7 6212 bytes
SHA-256: 60a4bd9856d8ba0e6d0d50feb54e62bef24937e7cb0a5dfe216a2c171ba30086
font_04_sfnt_off00012be7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12BE7 28016 bytes
SHA-256: 0b722c4c6ba9649613f4a9097d61029ee37b4f964f91b562143a7368433ea0ed
font_05_sfnt_off00017570.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17570 26596 bytes
SHA-256: d408ded5052b9854e2eed85084cd3528e59c0edc2c5e4065b75c1810e39bcb6c
font_06_sfnt_off0001baf1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1BAF1 32540 bytes
SHA-256: 795d1eb6ca7735712853376eee86dbbc50024d17a27d4bed26f6c5bd062e43ac
font_07_sfnt_off0001fe34.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FE34 2572 bytes
SHA-256: ddc09560e4c96f9c8cfc12629ca2515bfbace636dd8c8e180588154d88f308b7

Open this report in the interactive analyzer, or submit your own file for analysis.