PDF malware analysis — malicious · 2bace9621068a0a9

MALICIOUS

PDF

70.8 KB Created: 2020-12-25 10:47:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04

MD5: 406af01142b96872267dc4f131c2b932 SHA-1: 18eec2e96de73b52d339f735a0bf7d5d598ce821 SHA-256: 2bace9621068a0a98317355fac7639bf3ef53a2f21cd9381481da7f817c3c8e7

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/strik?utm_term=club+america+dream+league+soccer+2019 PDF link annotation
- https://cdn.sqhk.co/sepunaro/hgjibiJ/ib_chemistry_ia_guide.pdfIn PDF document text
- https://cdn.sqhk.co/zolaxadivowe/ST27OFY/domino_theory_cold_war_facts.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/dukexajuj/68297546325.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/235d4ae3-2b6a-41b4-a962-1663ad237699/8401040842.pdfIn PDF document text
- https://s3.amazonaws.com/jakujakula/damudipirati.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/32843fde-6321-41a1-b377-d93fd8cb82db/panasonic_sa-pt950_w1_error.pdfIn PDF document text
- https://s3.amazonaws.com/wuzalugiseto/progress_report_card_comments_elementary.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9dfd1f0b-fd6c-44e6-92d9-5c848f5311af/alfreds_essentials_of_music_theory_book_2_answer_key.pdfIn PDF document text
- https://s3.amazonaws.com/xomepixo/misugabuwukarowi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2524a2a0-fc25-4164-9299-8a4b1bfc588a/tiefling_skin_colors.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0859fc2d-81ae-4ec3-b681-6d098db0dd10/samsung_sgh_t399_firmware_download.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d340.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD340	5788 bytes
SHA-256: `66a3959201b215393f165a8430764426447f24074662ced77b19922890c13b77`
`font_01_sfnt_off0000e6d3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE6D3	11888 bytes
SHA-256: `f0abc60f812177856d8a4d65cd2b87dd015e6d9563ac6b7dcb8d0f3db714e8c1`

Open this report in the interactive analyzer, or submit your own file for analysis.