PDF malware analysis — malicious · e8d064f87fb1c015

MALICIOUS

PDF

56.3 KB Created: 2020-11-18 06:24:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-04

MD5: ebfd46dd5def13a48abc8505c8c17b20 SHA-1: 127e21780fdbe0dd62ec8bce67cd319c20c992f9 SHA-256: e8d064f87fb1c015b8e19bf6ef674985c7ead63ec3d369953bbfb13695aad928

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/123?utm_term=residual+worksheet+hw+44 PDF link annotation
- https://cdn-cms.f-static.net/uploads/4458388/normal_5fa46ea62a462.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4427821/normal_5f9800344380a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4487206/normal_5fb4529552de1.pdfIn PDF document text
- https://saxibodusazo.weebly.com/uploads/1/3/0/7/130740440/xupanada-jakitivabukejim-vedogozunaluna.pdfIn PDF document text
- https://folugaso.weebly.com/uploads/1/3/4/5/134503816/7b7f0f.pdfIn PDF document text
- https://vekaluledezo.weebly.com/uploads/1/3/4/2/134235689/bediwegazugek_dekoz_xewur.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/8518f1a0-423b-47fa-821d-4c1caa237a72/devuxu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fd168c75-c336-42d9-bbd4-4be311efb440/letter_to_dad_on_wedding_day_example.pdfIn PDF document text
- https://s3.amazonaws.com/gupuso/6133379675.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2b93d540-e527-4f96-bc10-6e967366c382/giponagosisupegamujikazub.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8ba5f2a8-6b36-4bc3-a7b0-ed7270d16505/63772766397.pdfIn PDF document text
- https://s3.amazonaws.com/magapeguwabe/43225879965.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000a5f7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA5F7	5164 bytes
SHA-256: `cf2e56972e911e217e08b14193fe239741edfa2e4c1ba2b16cc621fc6ebb1bab`
`font_01_sfnt_off0000b798.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB798	8496 bytes
SHA-256: `1651914c35b1633d9693e1d470ab9109f77cf87707fca389fc956199b63cc227`

Open this report in the interactive analyzer, or submit your own file for analysis.