PDF malware analysis — malicious · 029722d0d4ccb0bf

MALICIOUS

PDF

909.4 KB Created: 2021-05-31 14:56:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23

MD5: 518bb8293633cd0e54c81aca1f303757 SHA-1: e5053661e21d7ef4a0d9842bb5b7d44757c9d0aa SHA-256: 029722d0d4ccb0bf1e2aaf3ab8c0a6c5f9f209ed87939bd1842b2c835c6d205c

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.5527

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/strik?utm_term=respostas+quimica+a+ciencia+central+9+edi%25C3%25A7%25C3%25A3o PDF link annotation
- https://cdn-cms.f-static.net/uploads/4470837/normal_602ad7462f046.pdfIn PDF document text
- https://rivixemip.weebly.com/uploads/1/3/4/6/134609840/nakusi-vebiled-sakoso-fegumu.pdfIn PDF document text
- https://nuniladolu.weebly.com/uploads/1/3/0/7/130775245/xiperulojajo.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4377400/normal_602cd92e35296.pdfIn PDF document text
- https://jizufuvarax.weebly.com/uploads/1/3/1/1/131164460/5624256.pdfIn PDF document text
- https://gamupizesusaza.weebly.com/uploads/1/3/1/3/131398140/aba9e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4469145/normal_602478d80e3a6.pdfIn PDF document text
- https://giwaxevo.weebly.com/uploads/1/3/4/6/134644090/jogadozi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4380883/normal_602238c66f4ab.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4410016/normal_606bda0336b56.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/af3a0ab2-2271-40e0-b6b9-6d2b7b1640b3/ldg_z100_plus_manual_espaol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b2093870-336a-4ec9-8b9f-44a7749c3085/48888454695.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/df02ac24-8928-4a6a-88f7-8fa804001387/cyrano_de_bergerac_book_tickets.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cebb1a18-1d85-42b7-8d75-bcab758809f7/genie_pro_model_1024_remote_not_working.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1645a0b5-a2e7-48fc-be41-a5ec6e58200d/how_long_does_a_mobility_scooter_battery_last.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a2eaf4db-7723-486f-aacb-a89d5a33f707/gmat_official_guide_2019_download_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c49c1dba-bf79-4695-be87-98bae1bd0f78/medekamun.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/203ffbae-012a-432b-812e-37d058be1189/rotation_90_degrees_clockwise_about_the_origin_formula.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/257f0e60-aee8-4080-8341-6e7652726ae8/gorobe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9bb76fa3-f072-4b61-bcc9-6ef12c67a58b/70911672279.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8aff929f-b5fc-46c1-8acb-ce300464777f/zikobelikiw.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e31e5fac-46aa-4b5b-92f9-9c681bc5bf25/rupupixanonataxove.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/69363207-ebac-4d46-b528-25b2d8a7c8f8/burris_eliminator_3_manual.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000dbda0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDBDA0	6008 bytes
SHA-256: `a9808c25cbc3d2d0ea6a788c06eb911ff5aa046195281eff7e144563665c75f5`
`font_01_sfnt_off000dd129.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDD129	19692 bytes
SHA-256: `610be4f594ca13372c89e607f1d19396601a17639a5dae4c2804bd02c266e806`
`font_02_sfnt_off000e0a57.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE0A57	16144 bytes
SHA-256: `b8fe2a639652f882d013a9eb7a697e218ec11e6466025380e480bfb0d104a93d`

Open this report in the interactive analyzer, or submit your own file for analysis.