PDF malware analysis — malicious · ead1613a0b1228c9

MALICIOUS

PDF

77.1 KB Created: 2020-11-23 11:08:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 1d1b8dcddaa9e7d844f4c2a4168c96ba SHA-1: 94f761bf28046b809fc61a01d9d9b1b809cbe8ed SHA-256: ead1613a0b1228c983ec52087507898061a84a94837c534e42c85154461637dc

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The ClamAV detection and ML classifier strongly indicate malicious intent, consistent with a phishing lure. No scripts were extracted, but the presence of an external URI is a primary indicator of compromise.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/123?utm_term=wow+classic+shaman+talent+points
- https://cdn-cms.f-static.net/uploads/4479210/normal_5fa776eb7ebf2.pdf
- https://cdn-cms.f-static.net/uploads/4371790/normal_5f8f18533f3ad.pdf
- https://cdn-cms.f-static.net/uploads/4480580/normal_5fb8f54fc69a4.pdf
- https://cdn-cms.f-static.net/uploads/4419441/normal_5f968b1945719.pdf
- https://cdn-cms.f-static.net/uploads/4390641/normal_5fa72f651278e.pdf
- https://cdn-cms.f-static.net/uploads/4368950/normal_5f89049a4e4a9.pdf
- https://cdn-cms.f-static.net/uploads/4404953/normal_5faaccaab6c6d.pdf
- https://cdn-cms.f-static.net/uploads/4366402/normal_5f872f125c9ce.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/56f64402-932a-4419-a9bd-e6bf697f25ac/53764244539.pdf
- https://uploads.strikinglycdn.com/files/4cb247eb-69ad-4cdc-9b21-efdb040f73fe/tapukidumojibozeluveja.pdf
- https://uploads.strikinglycdn.com/files/43f61638-d05c-4e47-8faf-242fbf9390b0/powavukul.pdf
- https://uploads.strikinglycdn.com/files/6716475d-fe89-4b6b-b432-58af5266f1ec/70783770808.pdf
- https://uploads.strikinglycdn.com/files/8e895f68-067f-4a1a-853a-d0c069185c7f/mhw_weapon_ranking.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e48f.bin` `3d20c6ccbc5076f1823d29a50b599dae7fab0e47501146f469e0e0b8c44e7fa5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE48F	4972 bytes
`font_01_sfnt_off0000f559.bin` `7cd21584223de043c3540c074546c0da2bd8e7c6a9a60007644bc28d5b42c484`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF559	10540 bytes
`font_02_sfnt_off00011941.bin` `05d2457133b820fa77aa358e30e9acfbad3f04c46ced9a37296d9311117db176`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11941	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.