Malicious PDF — malware analysis report

Static analysis result for SHA-256 c622381714af7b48…

MALICIOUS

PDF

69.7 KB Created: 2020-12-16 22:42:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 6eeafffaeb019e73f17f4776535c7d06 SHA-1: 1710e24e2855977a2148a631bfb30130aaf4d11f SHA-256: c622381714af7b4849081cb0bb4557546a0fef3029964b95fa1c6820e1e1f02c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ML classifiers and ClamAV as malicious. It contains an embedded URL pointing to a suspicious domain, trafffe.ru, which is likely used to host phishing content or distribute further malware. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of the malicious URL and the overall detection strongly suggest a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/strik?utm_term=thank+you+for+arguing+2013+pdf PDF link annotation
    • https://xefepalig.weebly.com/uploads/1/3/4/6/134679085/89567255164512d.pdfIn PDF document text
    • https://wonikisemuk.weebly.com/uploads/1/3/4/9/134902350/guxefe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388839/normal_5f94279578dc7.pdfIn PDF document text
    • https://vukasusig.weebly.com/uploads/1/3/4/3/134349680/703079.pdfIn PDF document text
    • https://fiwisito.weebly.com/uploads/1/3/4/7/134715438/9034181.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4414332/normal_5fd2f8d497154.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427103/normal_5f9e4fb2db678.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/f11e6fab-c4bf-4eed-b03e-362c01495f2a/bogigaxeri.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0873a11f6a4198483d0f6/t/5fc0deb83f75b16643f44e04/1606475448911/bopudom.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbffb332bbd740658015355/t/5fc33896a97599144e60a1c6/1606629527492/ward_colorado_to_estes_park.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5ceef399-0cf6-4fc4-8dd2-2945f2099b05/orthodontic_model_trimming.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6675ec14dfd36fe172514/t/5fc88c19dcb5b260797ed589/1606978593415/mini_golf_houston_texas.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6675ec14dfd36fe172514/t/5fcc8f62d235d37878c009df/1607241574321/transferwise_fees_vs_paypal.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c637.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC637 5384 bytes
SHA-256: ee5c4884d591797ffae059dbfb45737e915d5a8fd8f5fd206931b19065153160
font_01_sfnt_off0000d875.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD875 10304 bytes
SHA-256: 585afc7367362be51279279641e4c10ece3156acf5489ee759dc19a0ed1226f8
font_02_sfnt_off0000fb8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB8E 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.