PDF malware analysis — malicious · 5a21e3e940acc661

MALICIOUS

PDF

66.3 KB Created: 2021-01-13 13:02:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11

MD5: d924c4cc271d486a51a439efa50f0a17 SHA-1: 9dd65a619085f5fda7147156e69fd48a2c2c72f9 SHA-256: 5a21e3e940acc6614c445a891d49a06d134e2058082f5f7ffd87882dd5ddd999

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that leads to a suspicious domain, identified by ML classifiers and ClamAV as malicious. The document body, though heavily corrupted, suggests a lure related to 'linear functions answers'. The presence of embedded URLs and the ML/ClamAV detections strongly indicate a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/123?utm_term=unit+4+linear+functions+answers PDF link annotation
- https://static.s123-cdn-static.com/uploads/4458615/normal_5fc7a2648cb3e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4454179/normal_5fc3d62f3ee23.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4421341/normal_5ffd714b4cfd1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374848/normal_5f8fa656d5c92.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4393916/normal_5fde1caa117ec.pdfIn PDF document text
- https://cdn.sqhk.co/rapenikidu/fatidaT/calculator_soup_fractions_simplify.pdfIn PDF document text
- https://cdn.sqhk.co/kululojilo/JWDzif7/saxijafeborijamuropejuju.pdfIn PDF document text
- https://cdn.sqhk.co/dorejewibiz/sQheK2f/revenge_of_sultans_cheats.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/gozifep/free_business_letter_heading_template.pdfIn PDF document text
- https://s3.amazonaws.com/zetare/96600070038.pdfIn PDF document text
- https://s3.amazonaws.com/fupanabivote/bye_bye_bye_nsync_video.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c467.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC467	5048 bytes
SHA-256: `74a1aa38d02011592c946571695eeca053e0ed1d8c4598b675326b75edaea13c`
`font_01_sfnt_off0000d5bf.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD5BF	11504 bytes
SHA-256: `fca27a3c8f00fd109199ad47b9da7b0147bf44649711de0da62f002999282c09`

Open this report in the interactive analyzer, or submit your own file for analysis.