Malicious PDF — malware analysis report

Static analysis result for SHA-256 c73e146a89422690…

MALICIOUS

PDF

81.8 KB Created: 2020-12-21 20:31:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: f4c76f5a9450b28d72ba4fb1845feba5 SHA-1: d69240c9cc49443c2184f558153f090fc342cd9e SHA-256: c73e146a8942269015005bda2f6a3b5c39ccb015ed88a2481f0d8dbd227605c8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'trafffi.ru', which is likely part of a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/123?utm_term=minecraft+fill+command+air+ps4 PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4418379/normal_5fcf693651fc7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4416919/normal_5fbe6562bc993.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/7e1f2828-79bc-4481-80c0-aaef4487ea80/vajozalokesu.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc052d83dfdd95b60d21819/t/5fc1df49eaf37e3b64e075ea/1606541130189/dont_rest_your_head_wiki.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89e9496d-a61a-44ba-9e2f-9820c9a4e2ba/tinafuvuvutavasemuvalizes.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc6fa32a4492a057e20be12/t/5fc9b6528d0ac92c7be0b576/1607054931134/mamowufagobefitowurur.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc35f2d403f5353fda58b0d/t/5fcf0ed81901dd4d2ecc5e9a/1607405273278/vejuguxizowi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/34b8ed6a-e497-420a-ae1e-d39262167756/benjamin_pioneer_airbow_review.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88c6d0b4-2120-41d1-aec4-7ae25bbc4194/wogofodum.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b038af2-6dd4-4db5-9800-85950307309f/zidiwejisefalolu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2f1c6eb4-8818-415f-95ec-19b32343a7ae/dazed_and_confused_script.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc27e0b2cf09257bd761280/t/5fc3e14ef3de5e49b5dbaa2f/1606672719004/luwan.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/82c97bff-3bfb-425d-96fe-8d2431495365/kurli_walking_on_air.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6cb1594a-2c99-4f74-8690-56126b0846e4/enchanted_nancy_madore.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9f685032-f5c5-4dd8-bf18-0c3ec7270232/nolixejoserenalefulul.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off00011954.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11954 19520 bytes
SHA-256: e8ae88df9c997ecdf01428bf127ed2ff9f97bec617633763ed7e14101c683b1d
font_00_sfnt_off0000d692.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD692 2976 bytes
SHA-256: 96315f4005d3b97dd6949103e4905c85a2a4d42057c5b925cd2dc595bebd3768
font_01_sfnt_off0000e137.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE137 5396 bytes
SHA-256: cdfdbfcbc57dd1107eaaf548325d8975910207674db1600884be7c7473c679f0
font_02_sfnt_off0000f38b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF38B 10964 bytes
SHA-256: 55c1dac4dbfaef8061ba1fff556b70499a26675ad00cab8b509bb9ad478fa5da

Open this report in the interactive analyzer, or submit your own file for analysis.