PDF malware analysis — malicious · 0f21221bee601d1f

MALICIOUS

PDF

70.4 KB Created: 2020-12-23 19:35:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2073aa0e1d0e755dacf487fa35a96eab SHA-1: de94b54b9fe6bdeffaf1db7114b510051a7a270e SHA-256: 0f21221bee601d1f153df67297f3a4bac886221b764c778e9dc275e7bfd83adc

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, disguised with a seemingly benign recipe title. Heuristic analysis and ML classification strongly indicate malicious intent, with ClamAV identifying it as a phishing trojan. The PDF structure itself does not contain executable scripts, but the presence of an external URL is a primary indicator of a phishing or malware delivery attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffine.ru/strik?utm_term=duncan+hines+lemon+pudding+cake+mix+recipe
- https://cdn-cms.f-static.net/uploads/4492246/normal_5fd5f0f7cf5e9.pdf
- https://cdn-cms.f-static.net/uploads/4385417/normal_5fba9495b768a.pdf
- https://cdn-cms.f-static.net/uploads/4404124/normal_5f9b95b496af3.pdf
- https://cdn-cms.f-static.net/uploads/4372074/normal_5f91455f7bc39.pdf
- https://cdn-cms.f-static.net/uploads/4415073/normal_5f9bb530590b2.pdf
- https://cdn-cms.f-static.net/uploads/4392656/normal_5fa61f0d94538.pdf
- https://cdn-cms.f-static.net/uploads/4384152/normal_5fda7189db3a0.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/lebaxa/65141927243.pdf
- https://s3.amazonaws.com/bipovoromoj/xilitijixigapigowogabo.pdf
- https://uploads.strikinglycdn.com/files/200f5f10-e143-4faf-8390-1d8a5cf64c93/21692599323.pdf
- https://s3.amazonaws.com/subud/sistem_atmosfera.pdf
- https://s3.amazonaws.com/xonobijikivo/acer_e1-_531_network_controller_driver.pdf
- https://uploads.strikinglycdn.com/files/141f5c50-5221-4943-b307-9ba8e97a50b7/l4d2_client_timed_out_2016.pdf
- https://s3.amazonaws.com/jodabiladezot/73961526577.pdf
- https://s3.amazonaws.com/mejifavo/examples_of_text_types_in_english.pdf
- https://s3.amazonaws.com/rurovikejigibu/significant_figures_practice_answer_key.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d4e2.bin` `a771ade85aa7ea43497a07ed91a3521f7268258ed7bfbb2850bb06b8cbd986e4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD4E2	5620 bytes
`font_01_sfnt_off0000e7d7.bin` `710a1900b03ebb371f85f65a55bcc43b905f7019b85fb2cd3e0b45021e99d8eb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE7D7	10864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.