PDF malware analysis — malicious · b3d3b4db53000dd2

MALICIOUS

PDF

52.4 KB Created: 2020-11-13 11:01:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5f8bf6ecefc2e442bd04f05162c69236 SHA-1: 553adef7ed4b67b3104b0d112aae4f18475d4b8e SHA-256: b3d3b4db53000dd24653671eda9a47809fd7e6651043d67aede7703445f780cf

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'trafficel.ru', which is likely a phishing or malware distribution domain. The PDF structure and metadata suggest it is an attempt to masquerade as a legitimate document to trick the user into visiting the malicious URL.

Machine Learning

Nyx PDF Classifier malicious score 0.8417

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/strik?utm_term=laser+light+security+alarm+project+report+pdf
- https://cdn-cms.f-static.net/uploads/4382974/normal_5f97531369201.pdf
- https://bozuzagon.weebly.com/uploads/1/3/4/6/134666742/9068671.pdf
- https://cdn-cms.f-static.net/uploads/4411701/normal_5f98973308a4b.pdf
- https://cdn-cms.f-static.net/uploads/4367302/normal_5f8ea48690459.pdf
- https://nofakuxuwuxow.weebly.com/uploads/1/3/4/6/134684799/916cc.pdf
- https://cdn-cms.f-static.net/uploads/4456989/normal_5fa044683cecf.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/ff4443cf-e961-445d-b26f-978af2b82cad/foleto.pdf
- https://uploads.strikinglycdn.com/files/fe35d8a2-934c-4640-9558-bf8382700b5d/mutilate_a_doll_2_download_new_version.pdf
- https://s3.amazonaws.com/nemafu/48572080128.pdf
- https://uploads.strikinglycdn.com/files/2be50b41-a9aa-4f3d-9e44-6ae63e50f961/12_angry_men_transcript.pdf
- https://uploads.strikinglycdn.com/files/28169744-3466-40cf-9589-22eb576dbc05/the_tallest_invader_zim.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c378.bin` `1c88de327dec61c71e9a9cbb768b5b310ac68277d96b1c65824e5e5cc8ded711`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC378	5464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.