PDF malware analysis — malicious · de771ddf2af3e67f

MALICIOUS

PDF

59.4 KB Created: 2020-11-26 10:26:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04

MD5: 891e713501bcc33ddcf7dc6723f2b8f3 SHA-1: 92ab5916d6a5f2905f7f0ff5a798bb34356919fa SHA-256: de771ddf2af3e67f131d3fe6cd349caf2b6669c1db83ee6b85c1ccba8e4ec3cd

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/strik?utm_term=e11+led+bulb+100w+equivalent PDF link annotation
- https://geredape.weebly.com/uploads/1/3/4/3/134349068/5513396.pdfIn PDF document text
- https://remitibomuko.weebly.com/uploads/1/3/4/8/134853657/9720127.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4459654/normal_5fb005a866b44.pdfIn PDF document text
- https://saxibodusazo.weebly.com/uploads/1/3/0/7/130740440/popelem.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374848/normal_5fa935ddb20a4.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/177466bb-231a-4726-8c45-b371b7bcb4a0/ram_status_code.pdfIn PDF document text
- https://s3.amazonaws.com/wejuvono/auld_lang_syne_robert_burns.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f378800a-090c-408c-80a5-fbf0127dcd31/86426768599.pdfIn PDF document text
- https://s3.amazonaws.com/kubafezin/96392586074.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/17d5bb98-4360-44bf-8c32-35b4cbc0627e/51520142137.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3bb8fc42-5216-4cf8-8b1f-c031a367167b/wepafuk.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000aa26.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAA26	5112 bytes
SHA-256: `2ade747c7dbaa1761c531dc34920ed6ecc24e0a38467f8f4acc15fac644cd8ca`
`font_01_sfnt_off0000bbb9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBBB9	10500 bytes
SHA-256: `2de9d2e3d99a30bec769cf988ab6420842c29eb6adc328d569c2d88a891999b9`

Open this report in the interactive analyzer, or submit your own file for analysis.