PDF malware analysis — malicious · 304242f4d1628815

MALICIOUS

PDF

65.0 KB Created: 2020-11-24 19:36:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05

MD5: d2d96137e0a588f2874a6063c5383b72 SHA-1: b017e4fc852fefd5da1c80393e97b6667df45ec8 SHA-256: 304242f4d16288157645736e2e8f96ad91536dfe8e3bc63149c69ef2ec231cfc

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/123?utm_term=hope+in+a+jar+book PDF link annotation
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/47ae32fa-19cf-486c-969b-235b284e3cee/battle_of_saratoga_turning_point_of_the_war.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0772a551-143d-4221-bc6f-7ec1bff2d0fa/gta_4_for_android_free_download_full.pdfIn PDF document text
- https://s3.amazonaws.com/zewimu/user_manual_for_bissell_proheat_pet.pdfIn PDF document text
- https://s3.amazonaws.com/zazelujeju/argumentative_essay_topics_for_high_school.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c24998bc-4712-49e6-be67-30ab328fd8b6/wosusizoju.pdfIn PDF document text
- https://s3.amazonaws.com/zidenigad/turning_pointe_dance_tulsa.pdfIn PDF document text
- https://s3.amazonaws.com/bisute/prophylactic_mastectomy_guidelines.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e28b7fcf-2962-468b-ac90-90d63048b77a/20365523136.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8765afe4-ea3e-416f-92df-3af4a30f68ab/mmlp2_download_zip.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6f240eac-264d-44a5-aa9a-8b3d519ba2b0/sipijuj.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c2de.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC2DE	4844 bytes
SHA-256: `bd4a1ffe298a3de146df2e901914bd0ddce15c361804a75c826c99044cbd7fa4`
`font_01_sfnt_off0000d369.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD369	11036 bytes
SHA-256: `b0088c52f75ef14980e7a0dfba7bd97a500ba8a91ef26195fa4c47028bc890de`

Open this report in the interactive analyzer, or submit your own file for analysis.