PDF malware analysis — malicious · 3d5788907f3ffc8a

MALICIOUS

PDF

76.1 KB Created: 2020-11-10 06:21:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 60c096318840ccbc9037579c0287176b SHA-1: 73b298f4b66e26e4328024c55971220bc5df2e6c SHA-256: 3d5788907f3ffc8a3cd30c0da3dee250b71007636706118513511347dbce9504

136 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1539 Steal Application Data

The sample is a PDF document flagged by ML classifiers and ClamAV as malicious. It contains a heuristic indicating an MFA or one-time-code harvesting lure, suggesting a credential phishing attempt. The embedded URL points to a domain associated with such activities.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
MFA / one-time-code harvesting lure high SE_MFA_LURE

Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffking.ru/123?keyword=exchange+csgo+skins+for+paypal
- https://cdn-cms.f-static.net/uploads/4367294/normal_5fa18aa62e63f.pdf
- https://cdn-cms.f-static.net/uploads/4446259/normal_5f9e4b3a4e1e0.pdf
- https://cdn-cms.f-static.net/uploads/4486200/normal_5fa9ec645c33f.pdf
- https://cdn-cms.f-static.net/uploads/4375522/normal_5fa2bc59dba76.pdf
- https://cdn-cms.f-static.net/uploads/4470017/normal_5fa993efbf4f1.pdf
- https://cdn-cms.f-static.net/uploads/4369651/normal_5f8e4490372e9.pdf
- https://cdn-cms.f-static.net/uploads/4406775/normal_5fa1a5ae87102.pdf
- https://cdn-cms.f-static.net/uploads/4413019/normal_5fa0162334491.pdf
- https://cdn-cms.f-static.net/uploads/4366319/normal_5f8f38996bb83.pdf
- https://cdn-cms.f-static.net/uploads/4485693/normal_5fa969b7751b8.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://s3.amazonaws.com/jamokaroxoj/faxewesi.pdf
- https://uploads.strikinglycdn.com/files/cc185e3b-6710-4d64-9b5e-1dda6523b78a/60907217387.pdf
- https://uploads.strikinglycdn.com/files/6082a950-60ab-4cea-8955-da7f0d1c2fd4/thule_truck_tire_chains.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dfbe.bin` `52971798c7f5c486288df66ae1e649b609c072629a0748165c97075673b18f4b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDFBE	5176 bytes
`font_01_sfnt_off0000f156.bin` `80e58757cd38cf2a55d30dc7a721aeaf463d7a6bcbf9de7031573bfed2f04054`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF156	10744 bytes
`font_02_sfnt_off000115f4.bin` `7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x115F4	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.