PDF malware analysis — malicious · 0665139fca03a560

MALICIOUS

PDF

96.7 KB Created: 2020-11-16 12:28:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: deadea0c5554d0c610871f272adc422e SHA-1: 73de0ccffa1f19471d47441719c18896415e6001 SHA-256: 0665139fca03a56070bff86da10433809ea0a32a76f515d5f243f014e936973c

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body text, though heavily obfuscated, contains a phrase that may serve as a lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/123?utm_term=gotovina+legija+stranaca
- https://cdn-cms.f-static.net/uploads/4422136/normal_5f99ee234351a.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/levovod/7493782089.pdf
- https://s3.amazonaws.com/fejenijovekozu/box_24_casino_guess_the_game_answer.pdf
- https://s3.amazonaws.com/jamokaroxoj/saddleback_educational_publishing_basic_english_grammar_book_2.pdf
- https://s3.amazonaws.com/henghuili-files/maths_book_for_class_9_icse.pdf
- https://s3.amazonaws.com/fukepez/rudani.pdf
- https://s3.amazonaws.com/felasorarabipis/47178490708.pdf
- https://s3.amazonaws.com/lebaxa/fupizowisixulunu.pdf
- https://s3.amazonaws.com/lokijuronig/in_cars_lyrics_meaning.pdf
- https://s3.amazonaws.com/jufowokedunod/significado_de_demografa.pdf
- https://uploads.strikinglycdn.com/files/cbcce39c-df28-4f91-888b-46b7d20a12d3/24964928215.pdf
- https://s3.amazonaws.com/bitizopovopaso/tejeg.pdf
- https://s3.amazonaws.com/tiduro/the_unfinished_nation_by_alan_brinkley.pdf
- https://s3.amazonaws.com/migivewuwe/70679587403.pdf
- https://s3.amazonaws.com/bokexizometun/zepiziwa.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000128e7.bin` `2a5f0e9cad92de7bfb70668471c6dd436fa6c8eb65a8493ef4c8d8ab4e6dd479`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x128E7	5136 bytes
`font_01_sfnt_off00013a80.bin` `966b3745837042302f6e7f61005332650687164931341ad711bfe92c4cb0e7a7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13A80	11136 bytes
`font_02_sfnt_off000160ff.bin` `3e66ce8c90719045bf8f6c8d5f716325bbce29c89c8399c9e71e7e90b46a9b16`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x160FF	16028 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.