PDF malware analysis — malicious · 591d7d90cc392711

MALICIOUS

PDF

67.6 KB Created: 2020-11-28 05:47:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 756c0514faefa423282fc2fd983b1ecc SHA-1: 49b6b51ad77f54467af78ed17689db9fda70c5a2 SHA-256: 591d7d90cc392711291347b5779452847cbebaddf20321a5b76768ccd7b5773d

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. The document body, though heavily obfuscated, contains text related to "tetanic contraction" and an external URI pointing to "traffset.ru". This suggests a social engineering lure to direct the user to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9506

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/strik?utm_term=what+is+tetanic+contraction
- https://cdn-cms.f-static.net/uploads/4481819/normal_5fabf39016173.pdf
- https://cdn-cms.f-static.net/uploads/4414352/normal_5f9f019bbca86.pdf
- https://cdn-cms.f-static.net/uploads/4378382/normal_5faaa7b4cc341.pdf
- https://cdn-cms.f-static.net/uploads/4377371/normal_5f8cf28489c71.pdf
- https://cdn-cms.f-static.net/uploads/4408587/normal_5fb87e323ec96.pdf
- https://cdn-cms.f-static.net/uploads/4463792/normal_5fb3666dc0925.pdf
- https://cdn-cms.f-static.net/uploads/4365545/normal_5fa2149f969e0.pdf
- https://cdn-cms.f-static.net/uploads/4412570/normal_5fbe32ef647d9.pdf
- https://cdn-cms.f-static.net/uploads/4422631/normal_5f99f4b55897e.pdf
- https://cdn-cms.f-static.net/uploads/4420448/normal_5f970696d78f6.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/kavitokolezub/2951385876.pdf
- https://s3.amazonaws.com/wanasuvedigo/zuxesukogasare.pdf
- https://s3.amazonaws.com/lunojol/gugabukudodiditikugan.pdf
- https://s3.amazonaws.com/xatojem/9975228499.pdf
- https://s3.amazonaws.com/vuxalirudidel/fagewa.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ff93.bin` `328195e96766a95843a418d9886eb28ea8d1dd879fe91ef8d0472b7f8cb22b3e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFF93	4868 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.