PDF malware analysis — malicious · 309b0a4ced9d1742

MALICIOUS

PDF

70.8 KB Created: 2020-11-10 10:02:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26

MD5: 758e8bcf6a9b8eeb6d4cb0bf9017deb0 SHA-1: 059310a178f3472e8d0b3eb397fc617e3d3078ca SHA-256: 309b0a4ced9d17426dc16956364a7c79f03848c141ad626501e536c823480df3

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URL that mimics a search result for 'anime fighting sim script pastebin', suggesting a phishing or social engineering lure. The PDF structure and embedded content indicate it's designed to redirect users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/123?keyword=anime+fighting+sim+script+pastebin PDF link annotation
- https://bibeliki.weebly.com/uploads/1/3/0/7/130738572/120c0bf62c84.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4388282/normal_5fa769717749e.pdfIn PDF document text
- https://nuzilemuf.weebly.com/uploads/1/3/4/4/134479477/2577007.pdfIn PDF document text
- https://jatorogerujew.weebly.com/uploads/1/3/2/7/132710569/a63fb.pdfIn PDF document text
- https://babikovinemixe.weebly.com/uploads/1/3/1/8/131856339/5827050.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4384323/normal_5f96ba4d460c6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418385/normal_5fa4a4b11793e.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/tuzamada/52377929200.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9708ccce-595f-4bc2-91f4-a3303d39c2ee/unblocked_games_basketball.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ee29e046-d99f-4815-8bab-e7ee4b2174a5/4688659715.pdfIn PDF document text
- https://s3.amazonaws.com/rimejiguvif/86963948967.pdfIn PDF document text
- https://s3.amazonaws.com/desenaz/la_sportiva_python_2019.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d720.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD720	5528 bytes
SHA-256: `3f5c3c1811155c93d39a6b23a03e8c5b2bc95a4ac0aaf934de5e19a1437c46fc`
`font_01_sfnt_off0000e9ca.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE9CA	10612 bytes
SHA-256: `4a852c355cb0c9acc5acefae28acd7b75359c9d1ae94d66aa84a90b60fc7d8bd`

Open this report in the interactive analyzer, or submit your own file for analysis.