PDF malware analysis — malicious · c76140a3280660ef

MALICIOUS

PDF

69.8 KB Created: 2020-11-19 08:28:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-05

MD5: 4858141dc365fe652fa6ff2467b15733 SHA-1: 226dca4616c2045c9d7523807a0e85834efb88ab SHA-256: c76140a3280660efe4f0e53a8198b293a1f8ede887cbc92a00a3b9551b46c659

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ML classifiers and ClamAV as malicious. It contains an embedded URL pointing to a suspicious domain, which is likely used for phishing or to download a secondary payload. The document body, though heavily obfuscated, suggests a lure related to a 'guide'. No scripts were extracted, but the PDF structure itself is indicative of malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffi.ru/strik?utm_term=grand+fantasia+reincarnation+guide PDF link annotation
- https://rizowexerezo.weebly.com/uploads/1/3/4/2/134265486/ee52e1ea0973.pdfIn PDF document text
- https://vigasobokaj.weebly.com/uploads/1/3/4/6/134619364/986bf02.pdfIn PDF document text
- https://veforolafumokiv.weebly.com/uploads/1/3/4/3/134340642/nawazuk_xiradowesi_likawuf_gikelowig.pdfIn PDF document text
- https://kufazijofiw.weebly.com/uploads/1/3/0/7/130776126/0265c60dfa0b1a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/3ac9b8e9-d58c-4982-b121-2faa267ac42e/refadudanubejisiwu.pdfIn PDF document text
- https://s3.amazonaws.com/jolufozo/loopholes_of_real_estate_garrett_sutton.pdfIn PDF document text
- https://s3.amazonaws.com/tokit/79129739450.pdfIn PDF document text
- https://s3.amazonaws.com/jefobexapulow/53125968881.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/981f22c1-2445-463e-9a54-234045441869/tamilgun_arjun_reddy.pdfIn PDF document text
- https://s3.amazonaws.com/rekibedafowow/witikekomuk.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d13b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD13B	5188 bytes
SHA-256: `2dfd6495b3fe414b407d8882ddab0c48bb42013150b6aa5742c67ee779b734e1`
`font_01_sfnt_off0000e2f5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE2F5	11672 bytes
SHA-256: `53cdff7071d16c8c85804db01db8b1037948e1f60a8513ad948f45606b2a4ab1`

Open this report in the interactive analyzer, or submit your own file for analysis.