Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ffc41f34f12d606…

MALICIOUS

PDF

73.5 KB Created: 2020-12-27 08:46:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14
MD5: edaa7dad4c0d4f44f5a55a3386df472c SHA-1: 39a859f7352e020adbf31190fb995387b8de1c09 SHA-256: 9ffc41f34f12d606fe569afc0bbbd510333580ffa52cc608a381bdfba49bc83b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to 'trafficel.ru', which is likely used for phishing or to download a secondary payload. The PDF structure and embedded content suggest it's designed to trick users into visiting this external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=basic+information+about+upsc PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4448724/normal_5fa4aeb7e141a.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369936/normal_5fca3c59258de.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419630/normal_5fcf8a2418e65.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4406216/normal_5fba40ab7bcde.pdfIn PDF document text
    • https://cdn.sqhk.co/ludukuni/jcjgghI/taming_master_novel_92.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4417419/normal_5fc9d8d6a5145.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/dbf30c67-9166-49d9-aa10-ad8f12c326d4/feeling_good_dr_burns.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c2134b9-5476-4832-bcc9-f079c6d3883c/44160013377.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a73c0e7a-51a5-41bf-92ca-f303988b5bdf/35697708658.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4cce9e7-21dc-4bb9-996d-801b4ba30aed/zinoxapokarixaro.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c84a929e-75f2-4deb-9bfb-7e76d401caff/wimuzawokomewodono.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/75c1d254-0d09-46e5-9fc2-73f66bd9730a/tamufanemala.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5fa0c2aa-f3f4-4364-bb2f-d029ecae9114/greedy_cave_guide_skill.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d3f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3F3 5084 bytes
SHA-256: 4b61145f05c185a8c7182179626891a67ca5ec2b3382e055ff171f738e999d5d
font_01_sfnt_off0000e50c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE50C 11208 bytes
SHA-256: 8d1e7a77155832de6144aabdb24151cfdd6232dc0c834351ad539e0d4ffcebfc
font_02_sfnt_off00010b13.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B13 4324 bytes
SHA-256: a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f

Open this report in the interactive analyzer, or submit your own file for analysis.