PDF malware analysis — malicious · 62824e7c948ff654

MALICIOUS

PDF

66.0 KB Created: 2020-11-24 07:02:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fcdbe149e0013c5fd353c736f601dd7f SHA-1: 1950aa6759f97b592dea87548e8b133ba85a6bac SHA-256: 62824e7c948ff6540b527760b3cadb80e275e8d1792bb93e78f1d6ac96696543

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, with a high risk score. It contains an embedded URI pointing to 'traffine.ru', which is likely a phishing or malware distribution domain. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDFs from web content, further supporting the lure-based attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffine.ru/strik?utm_term=our+souls+at+night+soundtrack PDF link annotation
- https://nofizosol.weebly.com/uploads/1/3/4/5/134500220/576105.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379969/normal_5fa14969e45cd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4425483/normal_5f9f3ac7b598e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393035/normal_5fbba0f9817b2.pdfIn PDF document text
- https://kivifakan.weebly.com/uploads/1/3/4/8/134870172/jixuwub_fisobipadagu_kasavofifu_xorilo.pdfIn PDF document text
- https://genolawibiwiz.weebly.com/uploads/1/3/4/3/134316454/siduvoruwovuwuleju.pdfIn PDF document text
- https://juzudibat.weebly.com/uploads/1/3/4/3/134328144/e45ed2.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/830680f2-27af-4b62-a014-bf0ee9cc71b3/88687570831.pdfIn PDF document text
- https://s3.amazonaws.com/tetazino/buffalo_milk_composition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/638fc8aa-72be-45c7-bac4-5c097b9e8ca2/zenith_carburetor_working.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c4da.bin` `8bc5fe96c2c70898f4d289d9686f06ddb362cbe0b9ab150b13cb71ea0da35205`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC4DA	5292 bytes
`font_01_sfnt_off0000d6cd.bin` `e7d45da39332d9c25d15e7902f9cb601fd1f5778d1e0721623476babfea83b9f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD6CD	10884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.