PDF malware analysis — malicious · 8d63156bc2f28fbb

MALICIOUS

PDF

79.3 KB Created: 2020-11-20 02:31:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d2724c1757f8c706bf0797ec357f7d4d SHA-1: 70a00096f65107f0195901318b073cffc144dd95 SHA-256: 8d63156bc2f28fbb6fb1167975c6ded46037cc1b17331d0d6263ffb65936e13e

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URL pointing to 'traffking.ru', which is likely used for phishing or to download a secondary payload. The document body is heavily obfuscated, but the presence of the external URI and the overall malicious verdict strongly suggest a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffking.ru/aws?utm_term=bombers+original+guide+des+tailles
- https://cdn-cms.f-static.net/uploads/4498882/normal_5fb4420d9f9ee.pdf
- https://cdn-cms.f-static.net/uploads/4376602/normal_5f90859d7129e.pdf
- https://cdn-cms.f-static.net/uploads/4451212/normal_5fa6a40296b10.pdf
- https://cdn-cms.f-static.net/uploads/4389792/normal_5fa5a47b20b35.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/47cdd1af-75fd-4a90-ae77-754f4aaaddf7/jikabizekonipuje.pdf
- https://s3.amazonaws.com/zumomasugipeno/44687286561.pdf
- https://uploads.strikinglycdn.com/files/8b1837c7-31c5-4862-86ca-848f8c904bea/22107167875.pdf
- https://uploads.strikinglycdn.com/files/83d5a280-67f8-487d-af1c-71eba4160121/supply_and_demand_worksheet_answers.pdf
- https://uploads.strikinglycdn.com/files/32adf979-7911-4e6e-9ffa-5a675ef68c16/ark_survival_evolved_painting_guide.pdf
- https://s3.amazonaws.com/gofiguj/macbeth_act_1_quiz_answers.pdf
- https://uploads.strikinglycdn.com/files/243748b0-cf65-4e88-ada1-c373c5d05b8e/85337522488.pdf
- https://uploads.strikinglycdn.com/files/5b11272a-b051-41da-a5ef-86cf9b7480e9/uf_quest_courses_spring_2020.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ea6b.bin` `0d8312e6ab7180b3022ca43fc48bf39df6cf6cd467cbd06295a92a92469813cd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEA6B	5216 bytes
`font_01_sfnt_off0000fbfe.bin` `3c5939e7e6a7c07e9477470f2141b753f3e5ed0b0e523ecf96b66d3f5156581d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFBFE	10668 bytes
`font_02_sfnt_off00012063.bin` `d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12063	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.