PDF malware analysis — malicious · 4e7a9d4f84bc35e6

MALICIOUS

PDF

80.3 KB Created: 2020-11-24 00:41:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04

MD5: 15989cfccb1e8111fef16a8c345a93c5 SHA-1: 2f67a12cf308e30344a893f15b6a5d57b29fc392 SHA-256: 4e7a9d4f84bc35e6747826e4b1259888abd49ef62c5a924a6455296481bf1d5c

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/123?utm_term=collecting+potato+cactus+osrs PDF link annotation
- https://cdn-cms.f-static.net/uploads/4369305/normal_5f99a5b3c82b4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369922/normal_5f9b1c0d40521.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/sowewazulejewi/scientific_calculator_991ms_free_for_pc.pdfIn PDF document text
- https://s3.amazonaws.com/jesidofefe/venalumefojutoxavobax.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6ce1a34a-9e68-452f-a9f3-aeac0bfe92b1/saxewovozi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c12d3d36-8e35-44bc-a073-1bf8bf990845/monipemalosasuvogut.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ec9da4a1-01b3-4756-a6a0-f064acf95593/mamorisugulovulipuvusi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/391618d5-5b6d-4c77-adb8-2fbfdbf6cfe3/where_to_buy_a_kombucha_scoby.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c11b2f5d-a79a-4176-8473-f01def2c7cce/tokyo_free_guide_service.pdfIn PDF document text
- https://s3.amazonaws.com/mexesazaxasa/9271666364.pdfIn PDF document text
- https://s3.amazonaws.com/memul/vedazajigilebufubefen.pdfIn PDF document text
- https://s3.amazonaws.com/vedexajawo/concepto_de_energias_renovables.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/720771e1-280d-4568-9f48-9dc9c4f05dd8/minecraft_pe_0.9.5_cretsiz_indir_oyun_cepte.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3af669c1-d12e-48a2-862f-ae7123df8294/universe_of_swords_mod.pdfIn PDF document text
- https://s3.amazonaws.com/zusevamasor/5186140552.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f143.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF143	5008 bytes
SHA-256: `b0d562dafd4561c7c6653400eaf2f306dba590824a1e88c3ca3d7bb1a08cb1ee`
`font_01_sfnt_off00010250.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10250	2992 bytes
SHA-256: `e6c61607670a08666fdd5728a8cae33fbd30d2f557915398a19efaea73734d9d`
`font_02_sfnt_off00010ea5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10EA5	11120 bytes
SHA-256: `fc8eb485d07b62ea0f450dc8313ba85569e6729bdfb1f9020b8b8fa165c57d37`

Open this report in the interactive analyzer, or submit your own file for analysis.