PDF malware analysis — malicious · d200780a5358e276

MALICIOUS

PDF

73.0 KB Created: 2021-01-12 12:19:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-14

MD5: f9d8a87352093fea4d14c851506148ef SHA-1: 2cc3bde6b372b761688a16570ed9fd0699b0f44f SHA-256: d200780a5358e27663ad3e7848fb1afe0b3d72f841edd699e72d18bb5ae571fe

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified by heuristics as a potential phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a malformed attempt to mimic search result content, further supporting a phishing or scam-related attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/aws?utm_term=metformin+sr+500+dose PDF link annotation
- https://site-1172896.mozfiles.com/files/1172896/meteor_shower_for_april_2020.pdfIn PDF document text
- https://site-1178320.mozfiles.com/files/1178320/free_cute_wallpapers_to_download.pdfIn PDF document text
- https://cdn.sqhk.co/bizujutenifo/iXicZZ4/36157402832.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4501794/normal_5fd91594d6145.pdfIn PDF document text
- https://site-1176351.mozfiles.com/files/1176351/pavumegiwapimafimiguse.pdfIn PDF document text
- https://cdn.sqhk.co/fuwifemi/aibigOe/w3school_php_tutorial_offline.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/besafefaf/google_calendar_sync_android_apk.pdfIn PDF document text
- https://s3.amazonaws.com/pavujiniz/acc_aha_guideline_heart_failure_2013.pdfIn PDF document text
- https://s3.amazonaws.com/wipotegadodorek/sisowula.pdfIn PDF document text
- https://s3.amazonaws.com/jejulurowev/bauerfeind_compression_socks_performance.pdfIn PDF document text
- https://s3.amazonaws.com/babuxufarizuxur/potas.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e244.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE244	5080 bytes
SHA-256: `5587dfba4c0a8a9454a45589fc2902d77e4a6bcb26ae8ea9f199874e540a4a01`
`font_01_sfnt_off0000f38d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF38D	10744 bytes
SHA-256: `12ef7aedb40d7ca1c9d897e8513c8627cbba025ea71c852294d01e902af1a3a0`

Open this report in the interactive analyzer, or submit your own file for analysis.