PDF malware analysis — malicious · 47a0606d8317a31c

MALICIOUS

PDF

70.4 KB Created: 2020-11-19 15:55:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7df7188516e4fe882e8fb007f361d63d SHA-1: 174a9795dab24e91b4941649d8de06a852a18ca9 SHA-256: 47a0606d8317a31c99ca3629531a5df1236056f558b086a9a337c4d46e83602f

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. An external URI, 'https://trafffe.ru/123?utm_term=aurora+teagarden+books+amazon', was found embedded within the document, suggesting a phishing or malware distribution attempt. The document body contains garbled text, but the presence of the malicious URL is the primary indicator of compromise.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/123?utm_term=aurora+teagarden+books+amazon
- https://cdn-cms.f-static.net/uploads/4367643/normal_5f8e4704e47b2.pdf
- https://cdn-cms.f-static.net/uploads/4393044/normal_5f961b090d352.pdf
- https://cdn-cms.f-static.net/uploads/4464080/normal_5fab095234fff.pdf
- https://cdn-cms.f-static.net/uploads/4388421/normal_5f9565566168b.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/0e8423ea-bff0-4def-94e5-402cda67d8e2/12458861076.pdf
- https://s3.amazonaws.com/woxewiwupir/jack-_o-_lantern_templates_stencils.pdf
- https://uploads.strikinglycdn.com/files/b149ce28-e426-425c-8b7a-7057ac8885db/razigenirefo.pdf
- https://uploads.strikinglycdn.com/files/0d82b50e-4501-4901-8ab9-24d71398a07e/71520878889.pdf
- https://uploads.strikinglycdn.com/files/9b8561b3-5d14-4573-860f-8c73f173b7f0/bebisakojino.pdf
- https://uploads.strikinglycdn.com/files/a4977816-8796-41f7-9f69-919f639ef273/manual_for_dell_inspiron_24_3000_series.pdf
- https://uploads.strikinglycdn.com/files/5bc8dfca-7dfb-4286-953e-9c3e03a4ec77/ouvrir_avec_word.pdf
- https://uploads.strikinglycdn.com/files/510eb746-200f-4b3b-aa29-d90e86e10eba/mivaputikirawe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c9f0.bin` `e1b415299c8a1d1a9add71e64f544a4b4b49c5cefeffd20b005f4758588f5138`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC9F0	5188 bytes
`font_01_sfnt_off0000db80.bin` `81278a4051bf8231bc6313d8119d6d135764316510926af99cec174fb2892015`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDB80	10436 bytes
`font_02_sfnt_off0000fef0.bin` `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFEF0	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.