PDF malware analysis — malicious · 198c27738dc71e8a

MALICIOUS

PDF

68.3 KB Created: 2020-11-11 13:51:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4248fbc983b445c9b797b7508fb1e517 SHA-1: 58e60365ef94719877bb5b11e7127cd1049307dc SHA-256: 198c27738dc71e8a8d9568576d4665ce511a127e7cb99bb18e669c56a5bcef3a

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that directs users to a suspicious domain, likely for phishing purposes. Heuristic analysis and ML classification strongly indicate malicious intent, with ClamAV identifying it as a phishing trojan. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, aligning with spearphishing tactics.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/123?keyword=sample+letter+from+a+doctor+to+an+airline
- https://cdn-cms.f-static.net/uploads/4382784/normal_5f93c9841262d.pdf
- https://cdn-cms.f-static.net/uploads/4369665/normal_5f9f07264e097.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/8ae1de34-a2d8-41c5-a29e-39fa6cefeaa6/encyclopedia_in_text_citation_mla_format.pdf
- https://s3.amazonaws.com/lanorolowu/10877225471.pdf
- https://s3.amazonaws.com/wivunonovef/epson_home_cinema_4010_4k_pro-uhd.pdf
- https://s3.amazonaws.com/tuxenipup/kufuwemapitok.pdf
- https://s3.amazonaws.com/begijufadi/science_word_that_starts_with_d.pdf
- https://s3.amazonaws.com/rokuwapesu/69074005262.pdf
- https://s3.amazonaws.com/nepawigexa/columbia_county_dmv_phone_number.pdf
- https://s3.amazonaws.com/jenisozazewubo/69184674271.pdf
- https://uploads.strikinglycdn.com/files/15119b30-1759-46fe-a144-34f4ca62dc6c/56938335245.pdf
- https://s3.amazonaws.com/tekujel/fatenow.pdf
- https://uploads.strikinglycdn.com/files/7df647d3-bb17-47b6-835e-a9d32bb4c105/bissell_little_green_machine_turbo_brush_instructions.pdf
- https://s3.amazonaws.com/kudufigunabi/nexen_roadian_atx_rh5_warranty.pdf
- https://uploads.strikinglycdn.com/files/e718b77e-8a27-4d50-a848-03c9453d0f3a/imperium_universalis_rome_guide.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cf97.bin` `cd77f5bba2a5027451180b892cc831f8751fe13b5266e66ad637aa75029a0523`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCF97	5228 bytes
`font_01_sfnt_off0000e149.bin` `742323a433e65d56209d1bc479f4df7d475b1c2675692940857d3bce84147b3c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE149	10204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.