PDF malware analysis — malicious · e67b6838ce9f2749

MALICIOUS

PDF

78.0 KB Created: 2020-11-18 09:41:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02

MD5: 3cc756e38dfb1769bb1c602ad04cea24 SHA-1: 904053c6c846925e7a6cc476a51713a82a49e314 SHA-256: e67b6838ce9f27494da1689aa261eef1bee5bd5cce29cc6d8c8f8afd2dac1083

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/strik?utm_term=infant+car+seat+height+and+weight+guidelines PDF link annotation
- https://cdn-cms.f-static.net/uploads/4475215/normal_5fa8b3db4b2b6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387232/normal_5f907c9c2486b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4487626/normal_5fb3fe5807dc2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367017/normal_5f91f0e4a9bed.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/jebupofedijakuk/gloomhaven_eclipse_class_guide.pdfIn PDF document text
- https://s3.amazonaws.com/boduxatavepe/wakizizogig.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6dfb9cf7-8fe1-4ced-9b4e-39a15d30b498/71150499316.pdfIn PDF document text
- https://s3.amazonaws.com/wizuluworafid/14511187507.pdfIn PDF document text
- https://s3.amazonaws.com/wumodukubaru/lg_wm3470hva_manual.pdfIn PDF document text
- https://s3.amazonaws.com/zukukelejurotef/saint_petersburg_metro_map_english.pdfIn PDF document text
- https://s3.amazonaws.com/lokijuronig/mugirivejekufozeji.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd872392-8ccf-4523-9ba8-e42c25d61311/jemelave.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c8d5eb9f-89bf-4f8b-82db-614b1ff7845d/kuvavotutenipomipitanit.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f43e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF43E	5312 bytes
SHA-256: `5a5e13f3700271477efa5c5f055e673a0a537d5515058b7b6ec7e19c39de8800`
`font_01_sfnt_off0001065d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1065D	10768 bytes
SHA-256: `1a1f24e2b3d5e0cc45e78c5397992664a54c966d012ed9992bdea96f8c7fbf17`

Open this report in the interactive analyzer, or submit your own file for analysis.