PDF malware analysis — malicious · 83fbe8488dcdf8ff

MALICIOUS

PDF

85.5 KB Created: 2020-11-18 00:14:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17

MD5: c6d076f1523bf4febc9a6e793cdd1238 SHA-1: 4e4a29c31de6d078d839ce5f450288a01011dd89 SHA-256: 83fbe8488dcdf8ffde9fcde3284a5e5eb4b6b00d1ca026c5855713f721ab4da5

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a potentially malicious resource. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The presence of an external URI suggests an attempt to redirect the user to a malicious site, likely for downloading further payloads or phishing for credentials.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/123?utm_term=biopsychology+pinel+8th+edition+pdf PDF link annotation
- https://cdn-cms.f-static.net/uploads/4372967/normal_5f9bc3ffa90d9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4381081/normal_5f8bb37e906fd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4389603/normal_5f91db7a6d782.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417138/normal_5f963b7d2b9c3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365662/normal_5f8ba7a930359.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367950/normal_5f87fa9bcb4d9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4448538/normal_5fa86d6681069.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/0a143d6c-03eb-4df2-b2a6-be98a777a50e/39902906024.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9454e5f7-c4c6-48e3-ac79-3ee519fc3bc3/xupuwisomazoxalitofiraw.pdfIn PDF document text
- https://s3.amazonaws.com/tokit/wanozaxexoner.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001116e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1116E	5456 bytes
SHA-256: `2f840da8c2274c031e63c07e974e8fe9f620fcb8fe7a796aee670af5a9875bcd`
`font_01_sfnt_off00012415.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12415	10888 bytes
SHA-256: `4ba82008611817a5a05e011f580fa3b1d481025a01969516f5a1ca70b18e3197`

Open this report in the interactive analyzer, or submit your own file for analysis.