PDF malware analysis — malicious · e042109c6c52f7fb

MALICIOUS

PDF

71.7 KB Created: 2020-12-22 14:07:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a049adc658328851d27d42c00e3aea67 SHA-1: d07e15a6c9320fd97290100802f17247e15c107b SHA-256: e042109c6c52f7fb22c050dde1c2369966f937716c1d5e13205a576b97a3f8ed

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains numerous external links, with one prominent URL leading to a potential phishing or malware download site. The document body, though heavily obfuscated, contains text related to 'Messenger download facebook chat', suggesting a social engineering lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/strik?utm_term=messenger+download+facebook+chat
- https://wubenigulusetib.weebly.com/uploads/1/3/4/7/134712949/xatawawetidokofis.pdf
- https://cdn-cms.f-static.net/uploads/4445726/normal_5fa24ad805931.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/werowibovezoje/absorption_costing_format_income_statement.pdf
- https://s3.amazonaws.com/levovod/mpdf_page-_break-_inside_float.pdf
- https://s3.amazonaws.com/widuxade/irish_credit_bureau_report_cost.pdf
- https://uploads.strikinglycdn.com/files/58127391-d334-4fd4-a9ae-212983238daf/deftones_diamond_eyes_owl.pdf
- https://s3.amazonaws.com/zalisujezajaje/nufitipumetexawuzabab.pdf
- https://uploads.strikinglycdn.com/files/ce8a6be2-fc39-4ff9-9c05-378a51db5df1/78099870623.pdf
- https://s3.amazonaws.com/lezerawe/kejodixugepumapa.pdf
- https://s3.amazonaws.com/jukezeluf/mhf4u_trig_identities_worksheet.pdf
- https://s3.amazonaws.com/gurafoga/modified_barthel_index_manual.pdf
- https://uploads.strikinglycdn.com/files/d1b26240-0f74-40f7-bee6-a64c1106996b/modavowedunaxuvisilu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dc2b.bin` `2ea92862c70c1b701fcffba2d6ca0f2ec3b563483af175c4a7565bb5f108e5c3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDC2B	5584 bytes
`font_01_sfnt_off0000ef43.bin` `da45dfcd01f8e1d369b63720fd542aa8f9fa01ec03ff4705f53b056203b68b53`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEF43	10236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.