PDF malware analysis — malicious · 9d743de0c0a93bf2

MALICIOUS

PDF

60.1 KB Created: 2020-12-04 09:38:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5c8e2f02b7f6d670dd41c152f57d4c90 SHA-1: 13ab01cd80311a1f258ffbe25a40646febf231ac SHA-256: 9d743de0c0a93bf2a3f72d53337c74c35f2c8e4e33120961db5e215271c4716b

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an external URI pointing to 'traffnew.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create malicious PDFs.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/123?utm_term=ever+after+high+madeline+hatter+tea+party
- https://nupejaxisolerez.weebly.com/uploads/1/3/4/3/134348845/3847805.pdf
- https://kawuloxegulul.weebly.com/uploads/1/3/4/3/134389306/fitupezefevom_kedijab_basol_rimiwifepizeli.pdf
- https://fuvipizewovotat.weebly.com/uploads/1/3/1/0/131069886/bewurilexagoduz_girek.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/72dfc1e3-1f0e-4a7b-819d-63b7e3d2b910/35040578660.pdf
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcfeb4b7ee8e70759ede07/1606221492988/ms_office_2010_book_in_hindi_download.pdf
- https://s3.amazonaws.com/rozebofukixus/48028192069.pdf
- https://s3.amazonaws.com/mesixadelomomo/29500746971.pdf
- https://uploads.strikinglycdn.com/files/66ee50fd-bbe9-47b5-b0bb-f2e169d95f40/93521669228.pdf
- https://uploads.strikinglycdn.com/files/03df8928-3665-4680-9001-2a28188c97a7/jerinufifuzuzuvimonabuxez.pdf
- https://uploads.strikinglycdn.com/files/f203c5bd-1c9e-45b1-b2a6-e3adf2240013/57301727567.pdf
- https://s3.amazonaws.com/jeromopelurab/lsat_preptest_82_answer_key.pdf
- https://s3.amazonaws.com/wulotugadag/19618352741.pdf
- https://s3.amazonaws.com/xuxifuzituwu/chemistry_notes_class_12_in_hindi.pdf
- https://uploads.strikinglycdn.com/files/2943ce51-b58e-4b4f-9e2d-a890fad86f1d/94835100049.pdf
- https://s3.amazonaws.com/pisedij/ziligiwofimova.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b07b.bin` `1a84259239b8c5d78c83f97034bf68ea3d71301da7859ade91614f5c8ccbf5ca`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB07B	5396 bytes
`font_01_sfnt_off0000c2c2.bin` `56e86f69f1e49b60ea35c7a06c93a583bd0109337ae4605f0e417c16778dc389`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC2C2	9548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.