Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7f31cc9e653ba46…

MALICIOUS

PDF

77.0 KB Created: 2020-12-22 04:54:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18
MD5: f3f6a507aad9191598665c55636b6ece SHA-1: 08e823598cc2f0f8f8832bde6e2f145a4ed04507 SHA-256: e7f31cc9e653ba4691c01f3155216fc5ab2e01b2339d98939b988a094845561b
156 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'trafffi.ru' suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and heuristic firings indicate it's designed to redirect users to malicious content, likely related to a fake application download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?utm_term=calculatrice+scientifique+graph+apk PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4447087/normal_5fb67eb59d705.pdfIn PDF document text
    • https://lupojevoken.weebly.com/uploads/1/3/4/4/134468235/xixinixeti_welonasesibabur_soxibomidami_bowunexe.pdfIn PDF document text
    • https://gonotelavekufuf.weebly.com/uploads/1/3/4/6/134615299/d092e62ee5.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fce0b02c83faa584acdbba3/t/5fd692850f11661d4c338460/1607897734419/74916872761.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fdfd930ff074777c9861b5f/t/5fe09ce0459323513b00e087/1608555745685/jobobuvoxavim.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/63f915f2-c9fe-47a4-8733-b13d7f155b7a/gusunoromal.pdfIn PDF document text
    • https://s3.amazonaws.com/satudifin/zevederigoditupir.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fe11ca3e3ba044ee8dffad7/t/5fe146d923faae37ab1d29b5/1608599257929/kreg_tool_circular_saw_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/71225dc5-0c4d-4f8a-bcc0-b003531d2698/39394935046.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/24de8cae-21ca-4004-af4c-9e9d0a2f6181/pisaxovawufoxevorenobe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ccd3f60-1c75-435f-98f7-0acc6bcad6f7/manual_de_bibliotecas_manuel_carrion.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fe11e1c59bb36377152c879/t/5fe1433f5ef6353cfb49cdd2/1608598338710/10395510140.pdfIn PDF document text
    • https://s3.amazonaws.com/pibabopuduj/10402453428.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000db86.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xDB86 12940 bytes
SHA-256: 861f9a2b6db7faf22925ea41dcd3b48d4bb135ddf13d3af4949d12e57f629895
font_00_sfnt_off0000c950.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC950 5372 bytes
SHA-256: aee699bbc995d3bfb0e35e20bea7498633c4edd9d30fa039387ded256fdc0176
font_02_sfnt_off0001008a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1008A 11512 bytes
SHA-256: 39f7c6bc10f95f774fdeb1a511e9064f31b3b57464e1d23c77613e07e99fec8c

Open this report in the interactive analyzer, or submit your own file for analysis.