PDF malware analysis — malicious · e982e06d6b33252c

MALICIOUS

PDF

71.6 KB Created: 2020-12-11 22:11:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: de5bc926ecf42fca0386621239cf3e0a SHA-1: 25b7e672ddbb0b4c4b3ae2dd8425a81804a9b603 SHA-256: e982e06d6b33252c2616de080cc765c0f03bff9188f998e8e5f48197079c3e84

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'trafftec.ru', which is likely a phishing or malware distribution site. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious resource, consistent with spearphishing tactics.

Machine Learning

Nyx PDF Classifier malicious score 0.7629

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/aws?utm_term=applied+computing+and+informatics+%25E5%25B0%258F%25E6%259C%25A8%25E8%2599%25AB
- https://cdn-cms.f-static.net/uploads/4390052/normal_5fa01b41cebc5.pdf
- https://s3.amazonaws.com/bawalidamovidud/xubuvolajupaviletoxi.pdf
- https://s3.amazonaws.com/xukonakefules/lamuba.pdf
- https://static1.squarespace.com/static/5fc13e7dd49dd12447366960/t/5fc3a99afa04221c718ff21e/1606658459146/april_12_1861_texas.pdf
- https://s3.amazonaws.com/fodose/tonogom.pdf
- https://s3.amazonaws.com/luramamelolem/gorham_sterling_patterns_1950s.pdf
- https://s3.amazonaws.com/nefagolom/99102250968.pdf
- https://s3.amazonaws.com/zarusegibitumet/pevogezibexawepipudikut.pdf
- https://s3.amazonaws.com/robumuduluwise/93252250254.pdf
- https://s3.amazonaws.com/ligole/fatal_attraction_ielts_reading_answers_key.pdf
- https://uploads.strikinglycdn.com/files/7f93992e-ce7f-404e-a044-14e9bcfda458/mokunumoduwiwovukazidit.pdf
- https://s3.amazonaws.com/lodazojamuva/lowrance_elite-4x_manual.pdf
- https://s3.amazonaws.com/fasanag/72569167530.pdf
- https://s3.amazonaws.com/nefomojuwet/51518124946.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe113d9b1ed03538a25ccc/1606291775336/when_i_play_videos_the_screen_is_black.pdf
- https://s3.amazonaws.com/defipedibe/dupurafisejabijimop.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cbd7.bin` `4aed3ffa65c4d292d057f1d636f190572d6b90481140a9c743f8d99fe1226b4e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCBD7	20528 bytes
`font_01_sfnt_off00010c43.bin` `6dbc471d7cd119770da0ae48b6435f60ee166702c16fd7c5dad652b400b67e25`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10C43	3352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.