PDF malware analysis — malicious · 9950e408ad55e44a

MALICIOUS

PDF

74.8 KB Created: 2021-01-06 16:53:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12

MD5: e1a8adc7afae0027571169de928a248a SHA-1: 1db79a5d3f37516334a4731f2e4cda43c4021dcc SHA-256: 9950e408ad55e44afe34846310f073b2ce110395756b84bcead32b47314bdc4b

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an embedded external URI pointing to a suspicious domain, likely intended for phishing. The ML classifier and ClamAV detection strongly suggest malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, appears to be a lure related to a career guide, further supporting a phishing attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/123?utm_term=the+complete+software+developer%2527s+career+guide+pdf+drive PDF link annotation
- https://cdn-cms.f-static.net/uploads/4407724/normal_5fa644dda1ee3.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4383471/normal_5ff3d5db2ca93.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372378/normal_5fa1c6a495e9e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480170/normal_5fd8400a5d077.pdfIn PDF document text
- https://rukinedofixod.weebly.com/uploads/1/3/4/3/134348838/6173379.pdfIn PDF document text
- https://zevenilusowaj.weebly.com/uploads/1/3/4/3/134324486/relajavujagudobolilo.pdfIn PDF document text
- https://wozomeki.weebly.com/uploads/1/3/0/7/130776066/xinoxevi.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/4d5433d0-f855-4c2f-8387-dcd201818e91/34532043114.pdfIn PDF document text
- https://s3.amazonaws.com/senodiw/leica_1600b_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b658b4e3-5556-4988-9000-a1def947094d/tibupuba.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e6bc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE6BC	5704 bytes
SHA-256: `fa7fe22c6f81a2171427b4933d0212f65304235ad42d4007cc27b2311a65f9fb`
`font_01_sfnt_off0000fa17.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFA17	10568 bytes
SHA-256: `6f76be21f5052a5770b2bc669a5c13a2bb998d2d2740e16c8324edd6d4cc3be6`

Open this report in the interactive analyzer, or submit your own file for analysis.