PDF malware analysis — malicious · d625ddc1e9789a30

MALICIOUS

PDF

73.9 KB Created: 2020-11-23 16:09:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-01

MD5: 4d54e28b00d4a180c8bcdc8cdc69cf8e SHA-1: d4d602c18746ba583ddfdf490da13d6a7d3f8b79 SHA-256: d625ddc1e9789a30460da5d6806e3212f70b91c13e8b1cb351b76de61e4e12c0

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/123?utm_term=yohanan+ben+zakkai+facts PDF link annotation
- https://cdn-cms.f-static.net/uploads/4372983/normal_5f97512dcc551.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4383327/normal_5fa1bb26ef22e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418791/normal_5f9ff9f57d556.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371509/normal_5f8c891a420f0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368238/normal_5f8d232bcee52.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4382619/normal_5f9650eee8320.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370302/normal_5fa05d8966212.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/fda4ec48-fb95-45e6-83cc-389b19f3a9cf/nozozonelatosojoligugeba.pdfIn PDF document text
- https://s3.amazonaws.com/welutizenop/jeguj.pdfIn PDF document text
- https://s3.amazonaws.com/dugibabafod/kefojikogemutavaxilojosu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2911408f-c1a5-43b0-9781-641f0f56ddca/raxulifumezowa.pdfIn PDF document text
- https://s3.amazonaws.com/gulapore/pure_monopoly_supply_curve.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6912e013-8ad0-4475-9cb6-1fd073254547/manual_for_lg_refrigerator.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e2bb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE2BB	5056 bytes
SHA-256: `36207f8751c99199ae0afd9fc6ae4ea65bd7156c53d0998fd6e31d61a0b50d44`
`font_01_sfnt_off0000f3ff.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF3FF	11580 bytes
SHA-256: `6ce131f390b67356c22a4f65d96fa1dabae18f12c93d0926eebe374833f73015`

Open this report in the interactive analyzer, or submit your own file for analysis.