PDF malware analysis — malicious · dbde62a08e599ce6

MALICIOUS

PDF

69.0 KB Created: 2020-12-14 03:28:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04

MD5: 36e436c80e20edf008cf879ef4cfc76a SHA-1: 9b6a7152e2425146e181080743da042d14043cd6 SHA-256: dbde62a08e599ce6d49241e00fc556f73530206c80558b138b28d43041982ecb

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/strik?utm_term=blueberry+upside+down+cake+serious+eats PDF link annotation
- https://notaxivarem.weebly.com/uploads/1/3/4/6/134633458/tewurisoxidale.pdfIn PDF document text
- https://tuboxivodase.weebly.com/uploads/1/3/4/3/134387713/2136911.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450417/normal_5fa74f3aef800.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4381321/normal_5fd05c16e1b05.pdfIn PDF document text
- https://rebumazezip.weebly.com/uploads/1/3/4/8/134860465/684b5082cc6c0f1.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/tadovu/jojunipikobogilorov.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/32ec6885-7eeb-4cc0-ba81-b31ef887387f/gedeb.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5a347e1e-1963-4ae1-aeab-c49521860746/canon_t31_bundles.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/36e5715f-0b95-403a-b5ae-49f3cb7cd674/71884085413.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e473f7d2-efa3-416b-b020-a09cd2b57a9e/50705373290.pdfIn PDF document text
- https://s3.amazonaws.com/satedafadusizo/biker_logo_vector_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aa5a4a89-4442-4eb3-a986-4a6833466a1b/lokurugapipazifefi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d15d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD15D	5512 bytes
SHA-256: `19863c746bc85c1f212ea32249ba27253819e27312ea369ad165e9f9face5ece`
`font_01_sfnt_off0000e43c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE43C	10200 bytes
SHA-256: `af89737ea5e084f09d99408a6c11250445a0128c3b74deb0aeda0b91aeb86916`

Open this report in the interactive analyzer, or submit your own file for analysis.