PDF malware analysis — malicious · c976c60dd8fe36f2

MALICIOUS

PDF

68.8 KB Created: 2020-11-14 01:14:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04

MD5: ca97312838dae2a75da5ce4e75e41960 SHA-1: 90e92d11be3e00638a194ad3b5579262c1abb09f SHA-256: c976c60dd8fe36f22c4bf30e11f9ab24c9a2a451d3ea36fab1b1080a4cfec365

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/123?utm_term=dermal+tone+instructions PDF link annotation
- https://cdn-cms.f-static.net/uploads/4406466/normal_5f9efd2908fe4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418791/normal_5fa1e7d8b3186.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366389/normal_5fa15e060b2db.pdfIn PDF document text
- https://butebonej.weebly.com/uploads/1/3/4/6/134640772/d909dab.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4422890/normal_5fae8dfc925be.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370063/normal_5fa6ec151428a.pdfIn PDF document text
- https://bijoxopibomer.weebly.com/uploads/1/3/4/3/134325560/nupebixov-pumojowowum-xawela-mubemojitufado.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4411250/normal_5fa7d9ff3936f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4458631/normal_5fa207cdda691.pdfIn PDF document text
- https://worivoka.weebly.com/uploads/1/3/4/5/134588103/6e563a3.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/gujutavevive/19917382034.pdfIn PDF document text
- https://s3.amazonaws.com/zufojadibi/tracing_sight_words_worksheets_kindergarten.pdfIn PDF document text
- https://s3.amazonaws.com/zevutebulaworel/agama_shastra_in_telugu.pdfIn PDF document text
- https://s3.amazonaws.com/jenisozazewubo/retexerosurowejaja.pdfIn PDF document text
- https://s3.amazonaws.com/pazifetanegapu/tourisme_pyrnes_orientales.pdfIn PDF document text
- https://s3.amazonaws.com/zuxime/lavixugowobexexif.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cfb7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCFB7	4944 bytes
SHA-256: `263aa9612c325931553532331c4b362f8f91d5e9e6cee76b5cc8f710c8a98f27`
`font_01_sfnt_off0000e071.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE071	11056 bytes
SHA-256: `18c871a282c20fc95b8b69775845cc0c1cb59e663107117cd881ccb66b04bfc5`

Open this report in the interactive analyzer, or submit your own file for analysis.