PDF malware analysis — malicious · d4ab6f6c85894474

MALICIOUS

PDF

75.1 KB Created: 2021-07-13 20:42:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: 99da71d958f9056971812e6d84edfa84 SHA-1: e91536ccc931392b1768b8a5ed009851c1eb2cff SHA-256: d4ab6f6c858944742582c6ac3f4e8a2fb9dd407f2360c65b4ac96df593e50a47

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'drafthe.ru', which is likely used to host a malicious payload or phishing page. The document body is heavily obfuscated, preventing a clear understanding of its direct content, but the presence of the malicious URL strongly suggests a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9680

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://drafthe.ru/square?utm_term=the+invisible+string+free+pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ed0c6667dd777ebfbcdd81/1626147942269/cornell_university_computer_science.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ed96b29a9df7051d3eaf46/1626183346847/all_generation_names.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e909cdf229ba2ea836274e/1625885133784/along_the_period_atomic_size.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e92a60309bd63f3d86550f/1625893472616/playstation_3_manual_update.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8df9af4fe78435a3713bb/1625874330036/fortnite_stretched_resolution.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ed83a32271a75a72d41f8c/1626178467348/siberian_forest_cat_price.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e8cb53d7d143313afedf5d/1625869139578/ask_answers_online.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e91348f107ff2467e87a27/1625887560493/introduction_to_sociology_short_answer_questions.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c45a.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC45A	16792 bytes
`font_01_sfnt_off0000dc6c.bin` `998aaf2a4fc14f7cd34533e0e19449faadce5343aa54c25f1a83173960666edc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDC6C	16944 bytes
`font_02_sfnt_off00010894.bin` `f4b85621bc4df9f70644772727e039f46c15c45955d28b86f7327c19651ff03e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10894	10664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.