PDF malware analysis — malicious · f3ffc5dc384498e5

MALICIOUS

PDF

67.0 KB Created: 2020-11-24 16:53:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26

MD5: b9878b4195926a4a24d7bffdfc7e7dee SHA-1: d5cc690e09feb995eed55f6ac1d0c61bc14fb64c SHA-256: f3ffc5dc384498e5eebdb805d1c13e6b86a22e17ba29703e620d64c2e7114656

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a lure related to Minecraft armor repair, directing users to a suspicious URL. ClamAV and ML classifiers flagged this PDF as malicious, specifically as a phishing trojan. The embedded URL is the primary indicator of malicious intent, likely leading to a phishing or malware download site.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffset.ru/strik?utm_term=repair+iron+armor+minecraft PDF link annotation
- https://cdn-cms.f-static.net/uploads/4379852/normal_5fa44de07cda9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4393911/normal_5faa19f38c542.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4456132/normal_5fb5a96e88aca.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/lupebesu/13069218997.pdfIn PDF document text
- https://s3.amazonaws.com/wejuvono/66170517334.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fe46d3b4-890f-4c22-9abf-b2aef05ffef0/88733403796.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/91905c0e-5e20-44e4-b123-e085f5a7e4e9/55319155330.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4ce61435-6080-4b11-b278-7bf0742c3eb5/20227157919.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7a620f69-230b-4714-8909-9b538c5cdba7/pilinezovelovow.pdfIn PDF document text
- https://s3.amazonaws.com/wopari/dibunuzidulelimusu.pdfIn PDF document text
- https://s3.amazonaws.com/falevi/inshore_fishing_guides_stuart_fl.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000c8fd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC8FD	4960 bytes
SHA-256: `6907598960d97b1ae81afa26271915172ea1a4eeaa6e7f7e34c8357b8009f97d`
`font_01_sfnt_off0000d9d0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD9D0	10888 bytes
SHA-256: `8531d72030dec5203c79a06961462c5b86457aa5d0e9ea8a1e2793677770007b`

Open this report in the interactive analyzer, or submit your own file for analysis.