PDF malware analysis — malicious · ef7c24a3e7c53ffb

MALICIOUS

PDF

65.2 KB Created: 2020-12-03 18:51:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14

MD5: 5b1776653021eb4f7595a4c0f5964de7 SHA-1: 04f586ac41cf4d590e3774b3103a09af7ef8926f SHA-256: ef7c24a3e7c53ffb11eb4f948dbba02ad0e061a6db1f835cc144096c96cbf2c4

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'trafffi.ru', which is likely used to host a phishing page or download further malicious content. The document body, though heavily obfuscated, suggests a lure related to 'Reactants and products of combustion'.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/123?utm_term=reactants+and+products+of+combustion PDF link annotation
- https://cdn-cms.f-static.net/uploads/4407989/normal_5f9cbd019dd4e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374682/normal_5f8daf9eb5ffe.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379726/normal_5fb4fec0e57da.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/dorobukasawituw/xoxalopoxer.pdfIn PDF document text
- https://s3.amazonaws.com/xezujuxoz/wafulo.pdfIn PDF document text
- https://s3.amazonaws.com/gomakobez/monsters_a_bedford_spotlight_reader.pdfIn PDF document text
- https://s3.amazonaws.com/gisujubolidine/bdo_class_guide_reddit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/da8a10ce-2fd0-491e-9105-0d1c0e2fb4f4/iso_15489_information_and_documentat.pdfIn PDF document text
- https://s3.amazonaws.com/minegikukovel/annual_payroll_tax_forms.pdfIn PDF document text
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe3c7d4f98375720abdc45/1606302846160/dowawofajupibuwu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c184.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC184	5416 bytes
SHA-256: `0a84a661ca5541deb0f77759bdf3b5f5295df86be27f83d759992c3ce1ff06d0`
`font_01_sfnt_off0000d3d8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD3D8	10644 bytes
SHA-256: `20658a905ee775d5d01f016cae3ab74eeb57be8530bb7b498a65b60e5cf55ac3`

Open this report in the interactive analyzer, or submit your own file for analysis.