PDF malware analysis — malicious · ba55f2a52ab29e39

MALICIOUS

PDF

66.7 KB Created: 2020-11-24 05:24:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04

MD5: 1d3c203004736b30999ce3567fd19b41 SHA-1: 9b324020b1fe3d9196d2ab171836548add14f5cc SHA-256: ba55f2a52ab29e391e11e8fc875f4222eea7bb98168552ac8559c85f6c375c4d

104 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/strik?utm_term=the+wounded+healer+henri+nouwen+free+download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4366965/normal_5f875b4cb9d83.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4386333/normal_5f97d29fe6a0b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/tesodagiwor/math_answers_key_grade_10.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/92eec54e-a75b-4f1f-9b07-8f6f8d3a38fc/metro_exodus_caspian_good_ending.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6096e3e4-0615-4b39-acad-32cf62997c11/1957862219.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/174877b8-a939-4aa5-867d-fff8852a6f9d/luweragonujog.pdfIn PDF document text
- https://s3.amazonaws.com/petubapizo/yahoo_mail_apk_apkpure.pdfIn PDF document text
- https://s3.amazonaws.com/nemafu/jeep_dealer_bedford_hills_ny.pdfIn PDF document text
- https://s3.amazonaws.com/wexoteluwag/wezuna.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/df6fb7c6-fe87-4806-8376-c88da919d4cb/elements_compounds_and_mixtures_worksheet_chemistry.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c861.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC861	4856 bytes
SHA-256: `41376c29fbd196795736a514301f64f316faa1a6dcaa75a92f17cb0571a87752`
`font_01_sfnt_off0000d8ed.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD8ED	10408 bytes
SHA-256: `ae11bb4e1920f91655ff71cf4d9ab04f151b7ea0ff52c841fc2a00767b09b6b4`

Open this report in the interactive analyzer, or submit your own file for analysis.