PDF malware analysis — malicious · cf74306c9578dc17

MALICIOUS

PDF

56.7 KB Created: 2020-12-15 11:55:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ea93f2095d983abcf90238c45e512543 SHA-1: d077a8680223c25400b69a877b6d9f28371dedfd SHA-256: cf74306c9578dc17760c2e0bee260dde443c8e184aaa664486d9253b3f191c71

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URL pointing to 'traffking.ru', which is likely used for phishing or to host a malicious payload. The document body, though heavily obfuscated, contains text related to phone repair services, suggesting a lure to trick users into visiting the malicious URL.

Machine Learning

Nyx PDF Classifier malicious score 0.7874

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffking.ru/strik?utm_term=fix+my+phone+sd+escondido+ca
- https://cdn-cms.f-static.net/uploads/4407306/normal_5fa14e8061b0f.pdf
- https://static.s123-cdn-static.com/uploads/4366632/normal_5fc7ce8277d72.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/b0ab8f72-bdd5-4c99-9e53-7f60a91a6203/parotususutizipufebezof.pdf
- https://uploads.strikinglycdn.com/files/4e1b327e-2161-4225-af90-5cb8b4929ec7/dabavomoleja.pdf
- https://uploads.strikinglycdn.com/files/4b06d3c4-eb1f-412e-8040-31fb976eaa2a/the_manifest_content_of_a_dream_is.pdf
- https://uploads.strikinglycdn.com/files/625759b5-10bf-43c8-a47d-24b42cd0c5c4/nepajafi.pdf
- https://uploads.strikinglycdn.com/files/db1d5c6e-811e-436d-bc1e-75cf3a69037a/89228531743.pdf
- https://s3.amazonaws.com/zunaduxa/fuditifuma.pdf
- https://uploads.strikinglycdn.com/files/8df116f5-10ad-49fc-837c-76737bdb0293/87557605894.pdf
- https://uploads.strikinglycdn.com/files/9ea80e6c-9ed0-455d-b288-ddda6b8e28b9/67838305554.pdf
- https://uploads.strikinglycdn.com/files/9613ecad-f2bf-4197-8cd6-cf140b1341cc/80045861846.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bdb0.bin` `47201350927fc64eaac851d476021f40449790313cd406ce530a5f2d0be902f6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBDB0	5308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.