PDF malware analysis — malicious · 7be73f1855fae51b

MALICIOUS

PDF

83.7 KB Created: 2020-11-25 02:28:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7ee4bb069132eead447e09e71f55fce1 SHA-1: 727a3018e4c087832dfdeae88cc341c60b8ea684 SHA-256: 7be73f1855fae51b088786bcb4d529bcc241b74eacb54331f9b0c92e1f517c89

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'https://traffset.ru/123?utm_term=the+scarlet+ibis+vocabulary+worksheet+answer+key', which is likely a phishing lure. The document body, though heavily obfuscated, suggests a pretext related to an answer key, aligning with a phishing attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/123?utm_term=the+scarlet+ibis+vocabulary+worksheet+answer+key
- https://cdn-cms.f-static.net/uploads/4476930/normal_5fbca23829b79.pdf
- https://gadebalemalun.weebly.com/uploads/1/3/4/4/134443756/korugerop.pdf
- https://cdn-cms.f-static.net/uploads/4388835/normal_5fa962b56c2d1.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/bivanud/bepisuwosamonozome.pdf
- https://uploads.strikinglycdn.com/files/477d93ae-b1af-45a0-9f29-11633424546b/loxawamapada.pdf
- https://uploads.strikinglycdn.com/files/de6a884a-7737-4daf-8854-e614394de391/35338847499.pdf
- https://uploads.strikinglycdn.com/files/4addc9cc-773c-441f-b533-ab06f680f03f/16938981835.pdf
- https://s3.amazonaws.com/bitizopovopaso/musicians_institute_curriculum.pdf
- https://s3.amazonaws.com/xovajukoxin/44363717271.pdf
- https://uploads.strikinglycdn.com/files/4a80c17b-057b-41c4-85f0-d1d4ffc736f3/58569250226.pdf
- https://s3.amazonaws.com/lixasifasi/numeros_primos_e_compostos_exercicios.pdf
- https://uploads.strikinglycdn.com/files/d8cb8074-e9e8-4977-9d82-72c099eb28d2/39717006884.pdf
- https://s3.amazonaws.com/geradi/34723897530.pdf
- https://uploads.strikinglycdn.com/files/48b3969a-3730-4d01-a959-adafba2a1216/684974687.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fe2e.bin` `c3e2e4ef5af4fc0261c0a2907e99fd9d75453d07c17efab7d0f926548ebeacbb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFE2E	3288 bytes
`font_01_sfnt_off000109ef.bin` `e58e641078ed736b2a8ecff317d44a81dbcc7096a1ecef521af08887b40ae468`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x109EF	5292 bytes
`font_02_sfnt_off00011c05.bin` `64bf7069fe6eac2f120d4472a5946a95d8a27537d67d8227ca8a1331ea9b21b9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11C05	10884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.