PDF malware analysis — malicious · c4b194e4f9736f0e

MALICIOUS

PDF

67.0 KB Created: 2020-12-19 22:02:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02

MD5: 68f2f027d6d825a71cd326011cdb5f29 SHA-1: 11a9b174578f3fd830f905526ed8333f12fd9fd2 SHA-256: c4b194e4f9736f0ef09281af13ac2e740e30878dc2fe04f1035831aa122b81a0

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/123?utm_term=not+for+bread+alone+pdf PDF link annotation
- https://toroborelap.weebly.com/uploads/1/3/4/8/134867907/135a4bc9f4ef20.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374013/normal_5fa106d0339dc.pdfIn PDF document text
- https://wurumoziwozosib.weebly.com/uploads/1/3/4/6/134644160/pulumobaza.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368218/normal_5f90f17f7e91a.pdfIn PDF document text
- https://nulejifoxomopik.weebly.com/uploads/1/3/1/4/131437436/jixuxag.pdfIn PDF document text
- https://nikokabiliru.weebly.com/uploads/1/3/1/4/131409463/difakotejunogubesu.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366055/normal_5f90ee717bbf7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://static1.squarespace.com/static/5fc0ed1560f2895dc1e7fe11/t/5fc2bb359d79364840e781c2/1606597451112/pimp_my_gun_2020.pdfIn PDF document text
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf581861e25426e12fc287/1606375448460/23992173599.pdfIn PDF document text
- https://s3.amazonaws.com/juliziwojatige/wafipexofosuladagudobug.pdfIn PDF document text
- https://s3.amazonaws.com/pazifetanegapu/mage_the_awakening_summoners.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ca4c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCA4C	4964 bytes
SHA-256: `8473d005d828769151b9852a91411a081ee3b83c173b91767247180a6330aa7f`
`font_01_sfnt_off0000db3f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDB3F	10624 bytes
SHA-256: `fae1d1e9841dc169759f2c7fcf5eb89766dbcd431181d317d60a0280f1c0a2b6`

Open this report in the interactive analyzer, or submit your own file for analysis.