PDF malware analysis — malicious · 33bfd30aa74923cf

MALICIOUS

PDF

60.8 KB Created: 2020-11-11 20:27:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07

MD5: 3b18644bb7247a955ef7f1949062d7bf SHA-1: 97d10dc295b9103c99367006f88220e2dcb6102b SHA-256: 33bfd30aa74923cfd71a12d5aec097fabb0b127d76b1073cf43ac013e17399df

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing or trojan. It contains an embedded URL that directs users to a suspicious domain, likely as part of a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9994

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/123?utm_term=modular+homes+sevierville+tn PDF link annotation
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4d2f39c7-48b1-4020-bf3c-0d12fccda1b2/supezab.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/588306b1-900d-4319-9faf-5a039e5f1643/finesezutu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f79c3b37-3b18-45f7-9ad7-800a9e81b562/tuzabegodikofadenoko.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/10ccc4c2-6ee6-4540-8948-8d9f4854f232/section_5_3_human_population_growth_answers.pdfIn PDF document text
- https://s3.amazonaws.com/vipinib/one_troy_ounce.999_fine_silver_value.pdfIn PDF document text
- https://s3.amazonaws.com/memul/software_architect_resume_samples.pdfIn PDF document text
- https://s3.amazonaws.com/zuwimadaneb/mewapimuku.pdfIn PDF document text
- https://s3.amazonaws.com/zirojopemup/home_dumbbell_exercises.pdfIn PDF document text
- https://s3.amazonaws.com/davolazupivowi/23238860961.pdfIn PDF document text
- https://s3.amazonaws.com/lorifumofelu/10489799588.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b24a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB24A	5132 bytes
SHA-256: `8d4d83c076f0b36c8396db696b3af068453118b38bc41ad2b46abf05542c8775`
`font_01_sfnt_off0000c3a2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC3A2	10284 bytes
SHA-256: `ad7e47881c8419d7602e6781374eb8cde0cadb2662a72fe09484648f15136f4b`

Open this report in the interactive analyzer, or submit your own file for analysis.