PDF malware analysis — malicious · 8a762a7f2e52c43c

MALICIOUS

PDF

92.5 KB Created: 2020-12-22 00:41:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c874563768afa3cc47d28444eef361fe SHA-1: 12dc1804ea0f7596d9845c9a1f9fa99264650d37 SHA-256: 8a762a7f2e52c43caa657028232fea51d846e8a99d130169bade80938be8abc4

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, likely intended to host a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, contains text related to 'motorbike racing calendar', suggesting a lure to entice users to click the malicious link.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/strik?utm_term=motorbike+racing+calendar+2019+uk
- https://cdn-cms.f-static.net/uploads/4372086/normal_5fc2c01a32801.pdf
- https://cdn-cms.f-static.net/uploads/4380090/normal_5f9d5ce367cb3.pdf
- https://static.s123-cdn-static.com/uploads/4420019/normal_5fc834b6039e1.pdf
- https://static.s123-cdn-static.com/uploads/4475383/normal_5fc6c6307a7b6.pdf
- https://cdn-cms.f-static.net/uploads/4394060/normal_5f9092f3bc347.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static1.squarespace.com/static/5fc0055e5687f52b6b7c450a/t/5fc15d124e98326c024342d7/1606507795027/bagibesaselajuxatupazixo.pdf
- https://s3.amazonaws.com/figugipopar/audiojungle_bundle_2015_vol._1_free.pdf
- https://s3.amazonaws.com/nemafu/10312765142.pdf
- https://static1.squarespace.com/static/5fc53ea4df132613bbda1867/t/5fcc190deb18547f4b738231/1607211278819/24627837915.pdf
- https://static1.squarespace.com/static/5fc2d0d9e5c7695ca9a82108/t/5fc772800791337046e5e4ff/1606906499812/best_online_soccer_retailers.pdf
- https://s3.amazonaws.com/lanorolowu/55073738846.pdf
- https://static1.squarespace.com/static/5fc01ccfc14dfd36feed28e9/t/5fcba1d8393ce47356374956/1607180761625/sonobifofugerobibenowa.pdf
- https://s3.amazonaws.com/gapivegek/ignition_temperature_of_fuels.pdf
- https://s3.amazonaws.com/kifutizijebuj/xekewubejofowufuzagitu.pdf
- https://s3.amazonaws.com/rowubunak/kenneth_cole_connect_watch_manual.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00012a3a.bin` `82ca0df80f590ad732e5f8e06ac5fed4f374b36699acdb33e11d356004796b78`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12A3A	5620 bytes
`font_01_sfnt_off00013d72.bin` `dea3a3b4699d1c9ff564e59d18578c8b3c057c6967dff46220b2c93699503cf4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13D72	11696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.