PDF malware analysis — malicious · 0c17e2278f797bc0

MALICIOUS

PDF

70.8 KB Created: 2020-11-25 08:29:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14

MD5: 3adc154772d6bc1faa3a7d35903f838d SHA-1: 1cd66616ccc4bf3404100f78835290369478b94d SHA-256: 0c17e2278f797bc05df581dfea87001192e51adcf9b19c072198fac9415d3dbc

136 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains heuristics indicating it is a phishing lure, redirecting users to the URL https://traffset.ru/123?utm_term=richard+foster+celebration+of+discipline. This URL is likely used to host a phishing page or download a second-stage payload. The ML classifier and ClamAV detection strongly support the malicious nature of this file.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/123?utm_term=richard+foster+celebration+of+discipline PDF link annotation
- https://mugilofovoki.weebly.com/uploads/1/3/4/6/134616553/232fb4a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367019/normal_5f98b88390d03.pdfIn PDF document text
- https://xoxatazafej.weebly.com/uploads/1/3/4/8/134861408/5771f42da42e32.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371514/normal_5f88729342699.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382627/normal_5f9a83e34c7ce.pdfIn PDF document text
- https://rugurujumififez.weebly.com/uploads/1/3/1/3/131384765/junotake-mavaxofili-pinopoba.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426408/normal_5fb586ae1d5b9.pdfIn PDF document text
- https://ratigejav.weebly.com/uploads/1/3/4/5/134576845/9059510.pdfIn PDF document text
- https://virataxutepubom.weebly.com/uploads/1/3/0/8/130874282/4414157.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/jutenojamega/jujerazotepofamatu.pdfIn PDF document text
- https://s3.amazonaws.com/rexogeguxosix/facets_healthcare_software.pdfIn PDF document text
- https://s3.amazonaws.com/bezorito/804003857.pdfIn PDF document text
- https://s3.amazonaws.com/widiku/akc_reunite_registration_form.pdfIn PDF document text
- https://s3.amazonaws.com/mubefula/jewel_monopoly_2020_rare_pieces.pdfIn PDF document text
- https://s3.amazonaws.com/xalexojaxipud/35805247290.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d7da.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD7DA	5392 bytes
SHA-256: `8972a22eac2dea49bc8496e0bd8e690fdbae16d96517d276845a778beff66f2a`
`font_01_sfnt_off0000ea28.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEA28	10740 bytes
SHA-256: `45ccdd0c0a8b1ddd2182eba76d8b0cb191c5f24ef5bff86432a500a9907eebae`

Open this report in the interactive analyzer, or submit your own file for analysis.