Malicious PDF — malware analysis report

Static analysis result for SHA-256 bddb8731b125c7e2…

MALICIOUS

PDF

92.2 KB Created: 2020-12-14 21:44:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 54e50511832e07ba35d354455cf95606 SHA-1: 963903859d9ff7a6f2b223f5087c6a9f3c342081 SHA-256: bddb8731b125c7e29da31c1c45297733b65740495388adbfd8bdf1b0a1e91abc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically identified as a phishing trojan. It contains an embedded URL pointing to 'trafffi.ru', which is likely part of a phishing or malware distribution scheme. While no scripts were explicitly extracted, the PDF structure and the nature of the embedded URL suggest an attempt to trick the user into visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=anti+adblock+killer+firefox+android PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static1.squarespace.com/static/5fc12052bd14ff0dd29e0ecd/t/5fc58a4f4f983757209c2410/1606781519558/74469688273.pdfIn PDF document text
    • https://s3.amazonaws.com/fomaralunex/bullet_requiem_apk_download.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0c991c6d9645836219624/t/5fc2f6e83c02f22b9d6f1419/1606612714731/64854660358.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf5a5b4e98326c0207d66e/1606376028806/blue_white_scar_lord_of_the_flies.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc38024e2fce462bc9c67ee/t/5fc8e47ea9f67830ca066681/1607001215023/jaxis.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5dc4e2e34347c70666e67/t/5fd6068fc4373837b900f83a/1607861913218/21072104028.pdfIn PDF document text
    • https://s3.amazonaws.com/fuwuzerijofa/walagidakodeno.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fce2459c190381d6d646dbe/t/5fd6a62696ed101a3e4b6365/1607902759236/11961726922.pdfIn PDF document text
    • https://s3.amazonaws.com/vixuwogetiv/metaparadigms_in_nursing_theory.pdfIn PDF document text
    • https://s3.amazonaws.com/naxozelozude/xezadilateputixumado.pdfIn PDF document text
    • https://s3.amazonaws.com/fefurorobumi/civil_engineering_impact_on_society.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc4d5a48139af03765e4d31/t/5fc82f5ed32d012678f02c95/1606954857328/11696934126.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc78cbdd2523e4b70c2822a/t/5fd13e7e315bb0561765de81/1607548542823/77123704405.pdfIn PDF document text
    • https://s3.amazonaws.com/zunewidimem/aapt_error_not_well-_formed_invalid_token.pdfIn PDF document text
    • https://s3.amazonaws.com/gafedupeba/9905719104.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010553.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10553 4884 bytes
SHA-256: 50a56cc58e4ea586f1c6fdb93b42fe275cf890c08f8b7029ee719e2321ad9dcb
font_01_sfnt_off000115f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x115F3 10800 bytes
SHA-256: a96387eed29926a169f447d011ec45461d10c61c5379f6a869ebd29399777d69
font_02_sfnt_off00013adc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13ADC 17444 bytes
SHA-256: 2e2406a23c4eda4333e1700c11bf9bf530ea6b24fb47f233129a6652b68d8e8d
font_03_sfnt_off00015519.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15519 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.