PDF malware analysis — malicious · f6692c78cef7b5e8

MALICIOUS

PDF

79.8 KB Created: 2020-11-29 17:44:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 6b91879dcd91bbbb51d61aa8cf75d3ff SHA-1: 141b06b6eb353c8e502a1f8a53df62b465eff4c1 SHA-256: f6692c78cef7b5e869d4c610a892980d387c5e27356d96490c316fe6dfe6a562

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for an external URI pointing to a suspicious domain, and the ML classifier strongly indicates maliciousness. The document body, though heavily obfuscated, contains text suggesting a lure related to a 'manual for kitchenaid dishwasher'. The primary IOC is the external URL identified.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/123?utm_term=manual+for+kitchenaid+dishwasher+kids-16
- https://cdn-cms.f-static.net/uploads/4367923/normal_5f8f4049176ad.pdf
- https://cdn-cms.f-static.net/uploads/4366402/normal_5fb809384e04b.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/vavebufevodutob/nunaxesevedumosubonoke.pdf
- https://s3.amazonaws.com/fatisake/daveb.pdf
- https://s3.amazonaws.com/baritexovopa/grammarly_apk_full_paid_version_for_pc.pdf
- https://s3.amazonaws.com/labitajaxatufib/cafeland_mod_apk_indir.pdf
- https://s3.amazonaws.com/topipovikapari/56084471679.pdf
- https://s3.amazonaws.com/kavitokolezub/aukstuju_simoniu_likimas_knyga.pdf
- https://uploads.strikinglycdn.com/files/c0664138-93f6-4200-a32a-7d17c25feb38/kizorudoxo.pdf
- https://s3.amazonaws.com/lijulijowivaze/ge_steam_cleaning_oven_owners_manual.pdf
- https://s3.amazonaws.com/suxugipipolazog/cartoon_online_io.pdf
- https://s3.amazonaws.com/gotenukevepunin/32291149031.pdf
- https://s3.amazonaws.com/lomuper/wedding_e_invitation_templates.pdf
- https://s3.amazonaws.com/vuterijoze/platform_en_francais.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off000107fc.bin` `46acdb3377b0e0568461184dc563acd900c7d31682d256a3dfa1dbf8c6f4ec24`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x107FC	24488 bytes
`font_00_sfnt_off0000ce6b.bin` `c4991fab2d475296af938dd47d8631f377206808c3a86e89077c69ecbf55365d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCE6B	5508 bytes
`font_01_sfnt_off0000e151.bin` `5eebac52679e5bf0305163b75ff50cce3deff78a05a10b50096ebbe0be460c77`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE151	11316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.