PDF malware analysis — malicious · 82c080474b21d40d

MALICIOUS

PDF

120.2 KB Created: 2020-12-23 05:06:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9f0ae8d332709aa379a21d63e0debaaa SHA-1: 48d47896fb49a54571b7a09965339d0aa2684eb9 SHA-256: 82c080474b21d40d432ef8508473a42fe130115062e60207a69e7d08cf56da32

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'trafftec.ru', which is likely a phishing or malware distribution site. The presence of PDF-specific heuristics and the ML classification strongly suggest this is a phishing lure delivered as a PDF attachment.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/123?utm_term=die+hard+4+script+pdf
- https://static.s123-cdn-static.com/uploads/4450045/normal_5fddca5548410.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/0f93247b-7b26-41a2-be8a-6b3c14c40fe8/1441281749.pdf
- https://s3.amazonaws.com/wilugugo/segment_routing_part_ii_traffic_engineering.pdf
- https://s3.amazonaws.com/nefunupu/weposijugifujefo.pdf
- https://uploads.strikinglycdn.com/files/ec7ed248-5528-4a38-918a-bb0dc1d7711f/88766134892.pdf
- https://s3.amazonaws.com/poresi/forge_domain_cleric_build.pdf
- https://s3.amazonaws.com/luborinizu/21782634586.pdf
- https://s3.amazonaws.com/suxiweke/97966628174.pdf
- https://s3.amazonaws.com/jonora/create_google_doc_form_template.pdf
- https://s3.amazonaws.com/rawesaragegugar/xorefejuw.pdf
- https://s3.amazonaws.com/xapijifas/b._ed_application_form_2018_rajasthan.pdf
- https://s3.amazonaws.com/tadovu/76325287125.pdf
- https://s3.amazonaws.com/sizadagazagaj/24024026396.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00017c3a.bin` `f18732035ceab0d7bf209b859f450540a7cc11083c83bf5f582f43f8273bc5bf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x17C3A	4868 bytes
`font_01_sfnt_off00018ce5.bin` `cda3459e6eb1bf7b009db5178703ce4384062c1d736199acc49555863f6ee0df`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x18CE5	10344 bytes
`font_02_sfnt_off0001b084.bin` `3a2bb6651a5ad642813d1e324805fe83a688734d44fd23e014c0665a2602df32`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1B084	16060 bytes
`font_03_sfnt_off0001c518.bin` `cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1C518	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.