Malicious PDF — malware analysis report

Static analysis result for SHA-256 de6f7a5ddc2ffe69…

MALICIOUS

PDF

180.1 KB Created: 2021-01-17 15:02:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-31
MD5: 1ed4b3b9043cdd9addea6db6f500ebec SHA-1: 22052306ef7e8cb4250352616415eb2bdf64d7ff SHA-256: de6f7a5ddc2ffe69e0de1f71a7bba780ca22cccaf6b6ea145ed2c58839139e0d
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, trafffi.ru, which is likely part of a phishing campaign. The document body, though heavily obfuscated, suggests a lure related to 'Catheter associated infection guidelines' and includes urgency language, reinforcing the phishing pretext. No scripts were extracted, but the presence of external URIs and the overall malicious classification strongly indicate a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=catheter+associated+infection+guidelines PDF link annotation
    • http://jofarofuwudeveb.66ghz.com/wafirivujexosoguv.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424632/normal_5f9a91ec9a202.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4467975/normal_6003361032b7a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384045/normal_5fbc4793cb578.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464707/normal_5fd1283dba25b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481164/normal_6003bac99b100.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sowirutelevolur/xopikowewev.pdfIn PDF document text
    • https://s3.amazonaws.com/minegikukovel/xonaremamajevenipom.pdfIn PDF document text
    • https://s3.amazonaws.com/suxiweke/7991565395.pdfIn PDF document text
    • http://litufowanukoro.epizy.com/inspection_report_template_with_pictures.pdfIn PDF document text
    • https://s3.amazonaws.com/jadere/vonorezitiwewubesasori.pdfIn PDF document text
    • https://s3.amazonaws.com/xijuxosisomuna/authorization_form_to_collect_passport_trinidad.pdfIn PDF document text
    • https://s3.amazonaws.com/bokexizometun/sample_accomplishment_report_on_teachers_day.pdfIn PDF document text
    • https://s3.amazonaws.com/rovuweraja/dududega.pdfIn PDF document text
    • https://s3.amazonaws.com/zidosozawok/81855071220.pdfIn PDF document text
    • https://s3.amazonaws.com/sefepugolupalax/93575535575.pdfIn PDF document text
    • https://s3.amazonaws.com/tetazino/anatomy_and_physiology_1_notes.pdfIn PDF document text
    • https://s3.amazonaws.com/loxopudizus/33876663402.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000272c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x272C7 5188 bytes
SHA-256: 6ae25c361b8af4acb4fc6164f02269dfccc8629e4cb5709a78505b7f1f1248d4
font_01_sfnt_off00028461.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28461 12368 bytes
SHA-256: 33ff55bc14c2819f7d9ceb3a7c5895e586fec3666e161aa66607b4c8905c4f99
font_02_sfnt_off0002acc5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2ACC5 16092 bytes
SHA-256: 3aad8f736d68201c4a8387338ab5b73e899d8d5dbdf6ead162eb48e90402f37f

Open this report in the interactive analyzer, or submit your own file for analysis.