PDF malware analysis — malicious · 190fd63f07980243

MALICIOUS

PDF

212.4 KB Created: 2021-04-02 12:50:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22

MD5: 61f106992f7068022012c40672bd852c SHA-1: 72bec7f15ff9a082d729bcc368d862e758be4c0e SHA-256: 190fd63f079802432e69d1bc52a88a4665193ae3d67689a80f79a38e7c73130e

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses brand-impersonation credential phishing. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9778

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH

Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://xebejadeveroj.weebly.com/uploads/1/3/0/9/130969735/tawaketiba.pdf.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://lozipotod.ru/123?utm_term=android+sdk+full+%25D8%25AF%25D8%25A7%25D9%2586%25D9%2584%25D9%2588%25D8%25AF PDF link annotation
- https://cdn.sqhk.co/pufojoloz/hehjujj/mimosunumi.pdfIn PDF document text
- https://xebejadeveroj.weebly.com/uploads/1/3/0/9/130969735/tawaketiba.pdfIn PDF document text
- https://cdn.sqhk.co/jidelugob/aQgjjcM/vezudejil.pdfIn PDF document text
- https://kokozorakozuwel.weebly.com/uploads/1/3/0/7/130775651/1705793.pdfIn PDF document text
- https://sovirolozemeze.weebly.com/uploads/1/3/4/3/134337586/pedaluxofizone.pdfIn PDF document text
- https://vogitoroxubas.weebly.com/uploads/1/3/0/7/130739894/pijajimu-xixagovadegeleb.pdfIn PDF document text
- https://cdn.sqhk.co/nuxarufodir/gjoNjir/situxobaf.pdfIn PDF document text
- https://cdn.sqhk.co/movijomo/iiaBjne/toss_em_all_fake_or_real.pdfIn PDF document text
- https://cdn.sqhk.co/kexofodatop/jfgcAPr/crossing_void_global_mod_apk.pdfIn PDF document text
- https://kijenelix.weebly.com/uploads/1/3/4/6/134612576/bupelufubami_gikawesap_rewovadifabol_poviwenu.pdfIn PDF document text
- https://tidosivapozagul.weebly.com/uploads/1/3/4/3/134390518/1388940.pdfIn PDF document text
- https://nozonefabizeg.weebly.com/uploads/1/3/0/9/130969368/e7294b132d7703.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4424400/normal_606355f6050ff.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4367922/normal_5fef158e259e8.pdfIn PDF document text
- https://sefoxobifi.weebly.com/uploads/1/3/6/0/136093232/3548618.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4465151/normal_6052b986bf693.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4460465/normal_5ff8506ad03e8.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://a2876ee3-c470-454a-91e2-e108d831033a.filesusr.com/ugd/e8dba5_8fbcae49898d4a31b0fbcd809b1c5778.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/ca41b6da-3768-4556-ac26-73ed29bc5224/fimusokolonumera.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/337bd132-1f85-43ff-9558-64d7107cd463/rise_and_grind_book_daymond_john.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f06a7723-6b25-469a-9508-2fbb01f77b03/under_the_dome_season_2_episode_4_watch_online.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4a0484f1-ede5-4237-94a1-1dc19f30dec9/ganamrutha_bodhini_tamil_book_free_download.pdfIn PDF document text
- https://13ea8442-998f-4f14-ba3b-7f37e53a414c.filesusr.com/ugd/008a9f_1c5f3a687cc74075a6a02a5dcac0c19f.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0002f6db.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2F6DB	4744 bytes
SHA-256: `0ad8c27dd86424aa2fa497e4d966a57ad4375a1ddf9621f230fcfc6df058f63c`
`font_01_sfnt_off00030715.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x30715	10244 bytes
SHA-256: `9f046b648d93dbd8379ed9c69224cb68f6145433d597379cbe7859ab193418fa`
`font_02_sfnt_off00032a2f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x32A2F	16496 bytes
SHA-256: `4c7a3f4c24acbd3dbc226cbb34235638bbd4ab16f36442789c2911b407bafc0a`

Open this report in the interactive analyzer, or submit your own file for analysis.