PDF malware analysis — malicious · d7166dd4cab5a488

MALICIOUS

PDF

59.6 KB Created: 2020-11-23 18:39:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02

MD5: 6925a44c3438ae51d2d3901d484436a5 SHA-1: d6b8e125c4849096830b146113c0a9fa89fadfa6 SHA-256: d7166dd4cab5a4885e5773d8083a8581e7eadca8728dabd580954f5cbce6308b

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/123?utm_term=brother+pr620+embroidery+machine+manual PDF link annotation
- https://xukanodipu.weebly.com/uploads/1/3/4/8/134885825/gokugatewifida.pdfIn PDF document text
- https://buliduxefexefux.weebly.com/uploads/1/3/1/6/131636978/44a83bc3b39050.pdfIn PDF document text
- https://tilawebaxipas.weebly.com/uploads/1/3/4/5/134576196/robifafe.pdfIn PDF document text
- https://basopuseg.weebly.com/uploads/1/3/4/7/134703880/vutupivofebunef_nogobiwiligujo_fezesuwujopevu.pdfIn PDF document text
- https://jiluzeros.weebly.com/uploads/1/3/4/3/134365673/vivofuvirakop.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/fe31f824-9ac3-401e-aeaa-4b4fb3d298b0/grung_dnd_5e_stat_block.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e3e09c43-cdef-4c97-8cd4-86fb7f40278b/customer_centric_selling.pdfIn PDF document text
- https://s3.amazonaws.com/sakaburepagase/14984683909.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ab6cb998-7720-4694-9cfb-45a74939b455/latibi.pdfIn PDF document text
- https://s3.amazonaws.com/xatojem/84064357341.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3af82d32-c0a5-40c3-a7b9-587ab27825bb/wirigiwosopowe.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ab14.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAB14	5852 bytes
SHA-256: `286c3a486cf675be0e9967971a794b404531e95351182c531dfd92165bd1519b`
`font_01_sfnt_off0000bed5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBED5	10584 bytes
SHA-256: `18d327c85dc9de6abd048a1b24ca24a647d8ec740418de116143416b0e9ed5db`

Open this report in the interactive analyzer, or submit your own file for analysis.