Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdec6eeda7b6b479…

MALICIOUS

PDF

79.6 KB Created: 2020-11-10 14:11:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dade99803f4071806f6d1faf28853541 SHA-1: 62d8fc9d39c0ee7eb8fb74419be1e61c9690e28c SHA-256: fdec6eeda7b6b479fe0681b70eef06093a092b30615156a9b8df85f4de5b7b98
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to 'trafffi.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to educational material, further supporting a phishing or social engineering attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/123?keyword=congruence+and+transformations+worksheet+pdf
    • https://cdn-cms.f-static.net/uploads/4373779/normal_5f8a611c2e5d1.pdf
    • https://cdn-cms.f-static.net/uploads/4419629/normal_5f9d2569c096e.pdf
    • https://cdn-cms.f-static.net/uploads/4413567/normal_5f9f9bf2b5ca6.pdf
    • https://cdn-cms.f-static.net/uploads/4387411/normal_5f90e6cfda7bb.pdf
    • https://cdn-cms.f-static.net/uploads/4387808/normal_5fa5abd7a43c1.pdf
    • http://fontawesome.iohttp://fontawesome.io/license/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5ba89bd3-8d30-4745-a8c2-681c43fd14d8/tujutikonosovuwodo.pdf
    • https://uploads.strikinglycdn.com/files/30b5ccfe-5125-44ba-829a-5d34fea7714b/50244359552.pdf
    • https://uploads.strikinglycdn.com/files/ad2b5237-9bae-40e2-9c19-ac29ae6c5910/tok_knowledge_questions_about_art.pdf
    • https://s3.amazonaws.com/tazibabebamep/cpo_focus_life_science_textbook.pdf
    • https://uploads.strikinglycdn.com/files/96c7ca0c-bdcb-4acc-8e02-be301738908c/rdrcef.exe_application_error.pdf
    • https://uploads.strikinglycdn.com/files/b1665736-1880-4590-887f-ddc71d5467d2/3970159003.pdf
    • https://s3.amazonaws.com/pusori/vanilla_leatherworking_guide_1-300.pdf
    • https://uploads.strikinglycdn.com/files/a487ed42-469f-4b03-82e4-ae39ae3ad6fe/gukavifimadubutul.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cdc0.bin
c00911d22435b8aab430729fd97edd7dc498b2f842d3eeed428839f153e98480		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCDC0 2120 bytes
font_01_sfnt_off0000d743.bin
8e79fa0f8578210ddc62a514e620daefdfcb0fbc2b1dafe894ef3d4d5e5c0315		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD743 2884 bytes
font_02_sfnt_off0000e185.bin
a51e840c514032de93304be79fea21637677455c771a96d94ff559b5b9c47788		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE185 5596 bytes
font_03_sfnt_off0000f47f.bin
20f64af47e66bbaa355d9172193d333bcb49a9f5fdbdf574e8c20dc1f6c4a913		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF47F 11052 bytes
font_04_sfnt_off00011a4e.bin
8553f6cbad774b4ce5cbd4e3f54b9e721e5f0349083f5f009435b0b82a04241f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A4E 16244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.