PDF malware analysis — malicious · 5f18cf4b7314e707

MALICIOUS

PDF

73.9 KB Created: 2020-12-16 01:10:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 595303eccdb253f4e51838d7106f7ab3 SHA-1: 175a986699676d23975e6b17720f3a2c44ab62ec SHA-256: 5f18cf4b7314e70731d477d558c6987bf898102c18b4e869d8be97102b3c2fc5

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, traffset.ru, which is likely used to host a malicious payload or redirect to a phishing site. The document body, though heavily obfuscated, appears to be a lure related to a technical document download.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/123?utm_term=introduction+to+mathematical+programming+winston+pdf+download
- https://cdn-cms.f-static.net/uploads/4492573/normal_5fc2146ec14d8.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/jozetej/emotions_vocabulary_chart.pdf
- https://uploads.strikinglycdn.com/files/6fd533f0-a280-468a-bee0-810d2059f933/king_craft_generator_manufacturer_manuals.pdf
- https://s3.amazonaws.com/nitatotol/christmas_card_photo_templates_free_printable.pdf
- https://s3.amazonaws.com/zaxuledo/steps_to_and_install_bootstrap.pdf
- https://s3.amazonaws.com/gupawupigawono/capstone_education_200_puzzle.pdf
- https://s3.amazonaws.com/xefejevife/24716989986.pdf
- https://s3.amazonaws.com/fosawef/dosipigovuvotewurilarima.pdf
- https://uploads.strikinglycdn.com/files/f8f584b9-3d70-460c-89dc-998c55f0a40a/96514143744.pdf
- https://uploads.strikinglycdn.com/files/3b50b88a-3280-4dac-9ea8-eeaaeb9a3edc/rifolukobozez.pdf
- https://s3.amazonaws.com/gurafoga/tuvez.pdf
- https://uploads.strikinglycdn.com/files/a7dc4fcc-f297-401c-a9e7-7b521818dbd6/rpc_computer_definition.pdf
- https://s3.amazonaws.com/libeganot/36156070955.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cb98.bin` `af8e319c4dcaf4f1f6651e9970a5f17a3299b112951f93c28c68af3c0d4084a8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCB98	5600 bytes
`font_01_sfnt_off0000de86.bin` `b8c51e8026d3eaeda9be3ffa9f3ad96bd03c5bce29a65344211471a85d5977f7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDE86	11212 bytes
`font_02_sfnt_off00010508.bin` `c33faafd911d2c4e8fea0807a017527063dea1be9a25b30e85ccf6f7667e82b6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10508	16076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.