PDF malware analysis — malicious · d9a5084f973f24d0

MALICIOUS

PDF

73.6 KB Created: 2020-12-18 06:47:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a27bae4aecea1fc799d0be72054c2998 SHA-1: 367936b88b2ed8fe62b7e962a007b063a6e666da SHA-256: d9a5084f973f24d0b3a49150a93b85f9433085f2a2a3801d9944befd76623602

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'traffmen.ru'. Additionally, a machine learning classifier and ClamAV detection strongly indicate malicious intent. The embedded URL is likely used to lure the user to a phishing or malware distribution site.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffmen.ru/strik?utm_term=step+six+worksheet
- https://static.s123-cdn-static.com/uploads/4490141/normal_5fc8df340af76.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/lupuvogotog/2020_open_enrollment_for_healthcare.pdf
- https://uploads.strikinglycdn.com/files/f8ab9ea9-145c-4677-99fe-27b9d6a3b263/kuta_software_infinite_geometry_answer_key_isosceles_and_equilateral_triangles.pdf
- https://s3.amazonaws.com/nonipesikiri/8535732817.pdf
- https://uploads.strikinglycdn.com/files/92ed5d50-0640-4269-b320-f7ee4f9820bd/2020_lancer_evo_price.pdf
- https://uploads.strikinglycdn.com/files/d2d0ee34-98ed-4313-9a0a-8a4e24a94123/91126703820.pdf
- https://s3.amazonaws.com/sitozi/27820608660.pdf
- https://static1.squarespace.com/static/5fc56d376b97992eb57a16b7/t/5fcdafd0c836a917f92adaa5/1607315408909/blocky_craft_survival_games_3d_2018.pdf
- https://s3.amazonaws.com/wemupajese/49110736418.pdf
- https://static1.squarespace.com/static/5fc697d2bd14ff0dd2c40102/t/5fd645eedf2f0204c2326853/1607878130122/dragon_age_2_mage_guide.pdf
- https://s3.amazonaws.com/febopa/97876596885.pdf
- https://s3.amazonaws.com/mudurixo/duel_links_reddit_guide.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e43a.bin` `29c7669b1afb34f2ad84d4a106645efa5222e8b82ba1c0a502b8d9f50620b96a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE43A	4992 bytes
`font_01_sfnt_off0000f54c.bin` `5e89887130a48aab7f1f745e5cfa6d57c78b5ca58be2974082c88ba7e2a0fe9d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF54C	10784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.