PDF malware analysis — malicious · ec5840d88a6b5175

MALICIOUS

PDF

66.7 KB Created: 2020-12-21 11:53:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e80960e2a24df3e79aa3056304d266c1 SHA-1: 53dcd74bd00ca5dfafed03c3e45af4d8f36ffd99 SHA-256: ec5840d88a6b5175b64ae728e0b431dcb4aa361fc26cb382513246727cce9773

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'trafficel.ru', which is likely part of a phishing or scam campaign. The document body, though heavily obfuscated, appears to reference 'Euchre 3d cheats', suggesting a lure to attract users interested in game cheats.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/123?utm_term=euchre+3d+cheats
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/ee7d6777-d36d-4b44-b8ca-c7334379a81a/52887588263.pdf
- https://uploads.strikinglycdn.com/files/31c59415-d1b7-4869-9969-c47d73b6a97d/82744872408.pdf
- https://uploads.strikinglycdn.com/files/973c7e1c-06a9-4048-8a05-939c68284599/vemebodan.pdf
- https://s3.amazonaws.com/defujo/frozen_2_123movieshub.pdf
- https://s3.amazonaws.com/vonuxagupeduze/sonia_sotomayor_book_summary.pdf
- https://uploads.strikinglycdn.com/files/04464aea-7cb2-42a4-b117-e635ef259b05/watch_moana_free.pdf
- https://s3.amazonaws.com/mexijegedakol/dazijosug.pdf
- https://s3.amazonaws.com/nitidadufetenu/best_html_editor_for_android_phone.pdf
- https://s3.amazonaws.com/levovod/wolonujuxojutire.pdf
- https://uploads.strikinglycdn.com/files/92aac2b4-7e57-4d44-8bec-7038d6b0f72a/marks_medical_biochemistry_5th_edition.pdf
- https://s3.amazonaws.com/fuzafuzeruwit/access_sheets_in_google_docs.pdf
- https://s3.amazonaws.com/xupizewuxere/xefojotuxamoziwix.pdf
- https://uploads.strikinglycdn.com/files/99a4cbaa-c42d-47c5-ab6a-1be4348a729e/nimodifatinemosemo.pdf
- https://s3.amazonaws.com/dogazisuze/ernest_cline_armada.pdf
- https://uploads.strikinglycdn.com/files/cfd8458f-554f-4b1f-8f12-3d73606b154e/bagutesel.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c8ba.bin` `e791be463bc086d4f0a958ddc33338a1288f49a0ac1e1fa4e21f95de9d419eb8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC8BA	5116 bytes
`font_01_sfnt_off0000da1a.bin` `d013009e725f600f6732b083a71a2ba670d3189dfeedb573fe2fce2ef55f8083`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDA1A	10596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.