PDF malware analysis — malicious · e3d5c0c44a4d3c27

MALICIOUS

PDF

66.1 KB Created: 2020-12-20 08:01:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18

MD5: ee4888ce9f134bfaf2848f174514a5c2 SHA-1: 850856dc17f88d87636e818acc7080d29bde3227 SHA-256: e3d5c0c44a4d3c2798e8b0c01de2d245b06ca7fbad144c7bd7bc5396049cb51f

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9983

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/aws?utm_term=windows+10+activated+setup PDF link annotation
- https://cdn-cms.f-static.net/uploads/4473359/normal_5fc02f02ad2e6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4403428/normal_5fb92862502b3.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/718534f6-cb82-4efe-b976-f81ca1328714/6934205087.pdfIn PDF document text
- https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf4eca1972c46e3c955133/1606373066966/descargar_whatsapp_apk_gratis_para_android_ultima_version.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a9a5f519-5d26-4a55-b2a7-74f868940025/22919474641.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1fc33535-74fd-436e-8789-a404b116249d/husqvarna_372xp_x_torq_workshop_manu.pdfIn PDF document text
- https://static1.squarespace.com/static/5fcf05868de95842221412ce/t/5fd71589491a58544a2943c7/1607931274834/vuluwebegib.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dc14d639-8d1e-4c1e-a22b-37cf8a75fb47/the_body_keeps_the_score_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d2951656-b204-4553-bf41-a03887680908/46094539864.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c5bc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC5BC	5296 bytes
SHA-256: `dfc2e62ef902d7e6af46684eb032f1ce5b2d820b005bc6547d80cee7c5ff4ae2`
`font_01_sfnt_off0000d7fb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD7FB	10552 bytes
SHA-256: `c33328bc86c5f2a8de28a0553e7e1ffdbeddbe581088da131abf311426826e92`

Open this report in the interactive analyzer, or submit your own file for analysis.