PDF malware analysis — malicious · ab22a50a0d4c6588

MALICIOUS

PDF

66.9 KB Created: 2020-11-23 12:08:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-01

MD5: 21a00dcd5d60fe44cedc35272bab3e30 SHA-1: dc259c796478bef42bd429cabe726865cb8bd342 SHA-256: ab22a50a0d4c6588386014db035267c274a19c95c046182b8a28a2d48a3d6ef0

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/strik?utm_term=apostila+de+ingles+completa PDF link annotation
- https://cdn-cms.f-static.net/uploads/4412568/normal_5f9d1910afe6f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4444638/normal_5faf54e4cfa06.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366661/normal_5f9c0b118b0a8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369138/normal_5f8aee5157606.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418778/normal_5f99bdd811e93.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/f2f4f94f-ff86-4956-b4d5-ba7ce15c62f5/18542224775.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cffc15c2-61eb-47b9-8dda-7cb63975055a/bilozejure.pdfIn PDF document text
- https://s3.amazonaws.com/zifozujiwi/15777521287.pdfIn PDF document text
- https://s3.amazonaws.com/zazelujeju/bed_bugs_laundry_sheets.pdfIn PDF document text
- https://s3.amazonaws.com/vunizi/keto_tone_avis.pdfIn PDF document text
- https://s3.amazonaws.com/gewuwasi/6489919963.pdfIn PDF document text
- https://s3.amazonaws.com/posufij/data_analysis_in_excel_2013.pdfIn PDF document text
- https://s3.amazonaws.com/mukutud/7587768205.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c7e7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC7E7	5288 bytes
SHA-256: `b306cd46ada480d5dbde35024cd4c0ece4ec5b9c70d7aa537cb50549e2026418`
`font_01_sfnt_off0000d9d7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD9D7	11072 bytes
SHA-256: `839b9eea87a09af9817bb6aff3ac144e8d8723b181048dfe3b1a3f0582328241`

Open this report in the interactive analyzer, or submit your own file for analysis.