PDF malware analysis — malicious · 04f54a6cbbc07075

MALICIOUS

PDF

82.2 KB Created: 2021-05-31 00:19:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24

MD5: 3b48f48d63cb015a3a927322f634f966 SHA-1: 58dc3c76c442faa6109f15ddf2d566e93f230d3c SHA-256: 04f54a6cbbc07075ace1580645448cd4d6d4ca4df330b5a09b4d9244324d3c13

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/strik?utm_term=how+do+i+fix+polaris+backup+valve PDF link annotation
- https://static.s123-cdn-static.com/uploads/4471723/normal_5fff0d8be6e99.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480755/normal_600bfdb77ff07.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4428083/normal_602cfca419763.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4443357/normal_602001199f5be.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480598/normal_606b4d83cbd13.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/823d219b-5533-4a5e-9290-2c9e7f99a5f0/gatotirud.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/445726c1-d86b-4404-8137-612dade344dd/delta_q_charger_repair.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fd86ff65-914c-4b4e-8d30-534d5ec3a523/kezulinegorafikenikel.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4660729a-5430-4b85-bd42-8ca7f0586e62/kekoletowoninewij.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/556fabe2-6606-40d8-83bd-5168a5f5eb00/xixogigusezoje.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f6abbc25-6bb8-44d0-bebe-f2dad6bb436f/viwimajatabotupewupufa.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f6fffcb8-7250-44cc-9ba9-e52391408589/56703647956.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c71395a6-5c5c-4952-bd00-aabf58e92e56/is_there_a_reset_button_on_a_jacuzzi_bathtub.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8264c024-715e-46a2-b284-088ff3c9eba3/bodimupopezapixevetem.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c0c6464b-9637-46b5-95d5-f00c1ceeb366/xobubuloxese.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2970272f-c677-4d57-bd3f-d357a2f93d31/pathoma_2018_vs_2020.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8040dbce-407e-4045-a78b-4d458fced199/59491525575.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5ce08803-3cd7-4e81-b1d9-c786b11d6074/78303556556.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/af8cfc27-5b51-4323-96d2-82c34171adfe/lowemojagobotiridoreniwi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/287f582d-7e2c-41c3-841a-45836bb2579d/purple_cow_menu_fairfield_maine.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f4c5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF4C5	5232 bytes
SHA-256: `ffabeebd6aa36c9d4b75869e2ea61251d6d781b28bcaa017bea6b76a0d43a96b`
`font_01_sfnt_off000106b8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x106B8	11340 bytes
SHA-256: `60985160ac89b99bdf1e8ef628d8763dc660f29f0341621331c350d16afa1a1f`
`font_02_sfnt_off00012cac.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12CAC	4324 bytes
SHA-256: `b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c`

Open this report in the interactive analyzer, or submit your own file for analysis.