PDF malware analysis — malicious · a14a68383167bdcb

MALICIOUS

PDF

73.3 KB Created: 2020-12-30 00:47:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02

MD5: f3b4e13ed2a676ebe3b11fe9c9b12ad2 SHA-1: 1dcf506fd295ff51713288b204efb769183a37c2 SHA-256: a14a68383167bdcb2ec0d43975861f6ad833a13852a5716cb07db7fbde483d6b

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/123?utm_term=realidades+2+capitulo+3b+answers+page+61 PDF link annotation
- https://xipuruvu.weebly.com/uploads/1/3/4/6/134654852/luwapenes.pdfIn PDF document text
- https://cdn.sqhk.co/barugogip/g9EQjgQ/vintage_pachinko_parts.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4473954/normal_5fafffa126a49.pdfIn PDF document text
- https://cdn.sqhk.co/zudilubal/gYCthif/cute_wallpapers_don_t_touch_my_phone.pdfIn PDF document text
- https://ralunudedosamot.weebly.com/uploads/1/3/4/8/134856058/5744611.pdfIn PDF document text
- https://finazodaxuvoj.weebly.com/uploads/1/3/2/6/132682535/papijifepenup-mogewesode.pdfIn PDF document text
- https://lufavipipoj.weebly.com/uploads/1/3/4/5/134580953/bedagujisewupojape.pdfIn PDF document text
- https://cdn.sqhk.co/jaxabofapuw/2jhnKei/sausage_dog_running.pdfIn PDF document text
- https://cdn.sqhk.co/kumipexa/gVie3Az/84942038787.pdfIn PDF document text
- https://cdn.sqhk.co/tiwumixe/0iZwjbx/divadisokabobiwazuziwo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/paxivogedewilu/lamozikavivadazikox.pdfIn PDF document text
- https://s3.amazonaws.com/verirejon/47310479703.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000de23.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDE23	5984 bytes
SHA-256: `59c4851b00d10fbdae0ca7f39f9769a9987164c87205039ae2a286bb5f0cc307`
`font_01_sfnt_off0000f2a1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF2A1	11276 bytes
SHA-256: `85462361f3f026fdd964f1489fca865b83c84f33d8a7020cee35a003af46c6f3`

Open this report in the interactive analyzer, or submit your own file for analysis.