PDF malware analysis — malicious · 0d7f86df03858df9

MALICIOUS

PDF

67.6 KB Created: 2020-11-24 18:03:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: daa2dc473ac43d759d578e031fdd04be SHA-1: 73b24e0cc0d93bf412d7b11e9ec24c11a723e134 SHA-256: 0d7f86df03858df958284b5a1bb239591590d824970062ec6fbf81eaa10b1e19

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link to a known malicious redirector, indicating a phishing attempt. The document body, though heavily obfuscated, contains text related to 'Tamu bus routes map', suggesting a lure. The ML classifier and ClamAV detection strongly indicate malicious intent, likely to redirect the user to a phishing site.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/strik?utm_term=tamu+bus+routes+map
- https://sisumojixidew.weebly.com/uploads/1/3/4/3/134355683/2904668.pdf
- https://moxitasa.weebly.com/uploads/1/3/1/4/131454719/0f71f38.pdf
- https://cdn-cms.f-static.net/uploads/4446380/normal_5faf89b76668c.pdf
- https://cdn-cms.f-static.net/uploads/4385228/normal_5fb2899ac3423.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/rekawexuretowo/pojikafa.pdf
- https://uploads.strikinglycdn.com/files/3db3d265-0b78-4b49-ab48-b7624831fc29/an_introduction_to_mathematical_cryptography.pdf
- https://s3.amazonaws.com/serogajugomiji/google_drive_apk_pc.pdf
- https://uploads.strikinglycdn.com/files/0cecb081-7245-40a1-af90-fa2d12a079fa/alcohol_boiling_point_trends.pdf
- https://uploads.strikinglycdn.com/files/b4c53bea-6957-4d91-bfbc-705d88ea7275/zatujolaguroxaromubutu.pdf
- https://s3.amazonaws.com/palevijuj/ikea_sofa_malaysia.pdf
- https://uploads.strikinglycdn.com/files/62511dd5-d459-48cb-abdd-efae4b1f0216/23217060582.pdf
- https://uploads.strikinglycdn.com/files/8ed43f0b-7dd4-4300-bd61-ca152111d3f3/simply_clear_cbd_review.pdf
- https://s3.amazonaws.com/pazaxazusa/98550765632.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cc6b.bin` `3ed3908beff6538d72dc3495e9a834ff1b0d4e8cd67028ee57e07b327bead80b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCC6B	5024 bytes
`font_01_sfnt_off0000dd5b.bin` `301a1c2dfbb0d2a1bc2102226b2964c37062ba6e63ac1df2fc53d74e177b17b4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDD5B	10712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.