PDF malware analysis — malicious · de9562f86e4442a1

MALICIOUS

PDF

62.5 KB Created: 2020-11-24 03:04:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e9736ebbbecad2451e2351c2aa3deaf9 SHA-1: 1aef24849fe42b8a77767dfae62f30f84107f21b SHA-256: de9562f86e4442a16c5b1f74582ccac8774e78c1c91f0ba6de9954845781e7ed

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific detection name indicating it's a phishing trojan. The embedded URL points to a domain that appears to be part of a phishing lure, disguised as a search result for an ebook. No scripts were extracted, but the PDF structure and embedded URI heuristic suggest a phishing attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/strik?utm_term=world+mythology+donna+rosenberg+3rd+edition+ebook
- https://cdn-cms.f-static.net/uploads/4427104/normal_5f97df834e8ab.pdf
- https://cdn-cms.f-static.net/uploads/4381108/normal_5f8b66d85667b.pdf
- https://cdn-cms.f-static.net/uploads/4368503/normal_5f8f45984eaf4.pdf
- https://cdn-cms.f-static.net/uploads/4459921/normal_5fa9b832c3206.pdf
- https://cdn-cms.f-static.net/uploads/4414486/normal_5fa6882df37ad.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/jaloto/mathematica_10_software_free.pdf
- https://uploads.strikinglycdn.com/files/b6a7cde4-4fb3-4159-a5ff-d6bdd3266b1e/89204374467.pdf
- https://uploads.strikinglycdn.com/files/317b9a9c-a8a6-4d33-b949-47f0096baa66/skater_apk_free_download_ios.pdf
- https://uploads.strikinglycdn.com/files/a1f3f8a1-66e2-42d9-96af-89589923ebcb/buwopofakasalesiwopurov.pdf
- https://uploads.strikinglycdn.com/files/8642c14c-e206-4053-89cb-b2133a4f66e3/tejavekagozotu.pdf
- https://s3.amazonaws.com/dotivaf/xiratifupurunezawezuve.pdf
- https://s3.amazonaws.com/xukonakefules/fedikenidewiwejij.pdf
- https://s3.amazonaws.com/tenunud/international_phonetic_alphabet_worksheet.pdf
- https://uploads.strikinglycdn.com/files/22a38745-1943-4a13-9c3d-32a90a32b4cc/21959317485.pdf
- https://uploads.strikinglycdn.com/files/2c991841-246b-4994-a74d-9d0dcb3f8534/neporewomazejujorobev.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b921.bin` `a6f55aa875a626a21969dae0badbc9937f545b882e44bf7d4b52e65857f53696`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB921	5724 bytes
`font_01_sfnt_off0000cc81.bin` `7137963b11c6785e88f5e59b753a988e53206c8dd40dc17208ad5364dc26ab1d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCC81	9532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.