PDF malware analysis — malicious · fa688687d5323fd5

MALICIOUS

PDF

59.3 KB Created: 2020-11-23 13:41:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-02

MD5: d7d10d6f8e89d91cdd3648016f8f5dbc SHA-1: 12dd878ed275762476b33cb400b557fcbf1a83bd SHA-256: fa688687d5323fd5d472d1b2846f035e90e05a35b6753c205c8d2832d46c88bd

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafficel.ru/123?utm_term=cafe+ole+coffee+beans PDF link annotation
- https://cdn-cms.f-static.net/uploads/4366407/normal_5f994c0dbd74b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4392462/normal_5fa52affc0b00.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368970/normal_5f87af7214146.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4378619/normal_5f904137038c8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4483833/normal_5fb6ca7f799f7.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/nemafu/nanosefuzunetinaj.pdfIn PDF document text
- https://s3.amazonaws.com/dujepav/excel_budget_template_college_student.pdfIn PDF document text
- https://s3.amazonaws.com/dalava/ronerepebidomunokaledukan.pdfIn PDF document text
- https://s3.amazonaws.com/tetazino/poraxovalozibukedomiza.pdfIn PDF document text
- https://s3.amazonaws.com/tobojelusiwi/dstv_catch_up_for_pc.pdfIn PDF document text
- https://s3.amazonaws.com/suzujewa/syllable_worksheets_third_grade.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1be974cf-c481-47d2-8f6d-e67d1746392b/empires_and_puzzles_best_titan_team.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000afea.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAFEA	4824 bytes
SHA-256: `a23dc8f5467f65edb05a21703a6f25ed9b75fc6653c0de932c8e2f5287cdd5c5`
`font_01_sfnt_off0000c067.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC067	9808 bytes
SHA-256: `cb462b769f69e58afc1caab3d5d98a0468869c788971d23db2c714138c327a11`

Open this report in the interactive analyzer, or submit your own file for analysis.