PDF malware analysis — malicious · 22484253f2eb5e62

MALICIOUS

PDF

227.9 KB Created: 2021-05-20 11:07:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23

MD5: 8bad1e21a844318b8278b31d7c79dfa8 SHA-1: 9d149b1ef1b7802872a8cc9aa722736eda641a5c SHA-256: 22484253f2eb5e6283b265ea4525451c71054e2ee6ab737fecfd8f81549c1027

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9715

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xezojetit.ru/strik?utm_term=manual+de+mi+ex+novia+fabio+fusaro+pdf PDF link annotation
- https://zerakilun.weebly.com/uploads/1/3/2/6/132695460/jubore.pdfIn PDF document text
- https://bilezebije.weebly.com/uploads/1/3/4/3/134344171/sorawixekixi-xesuwekinowuxa.pdfIn PDF document text
- https://webezajafe.weebly.com/uploads/1/3/4/7/134774073/xizutugak.pdfIn PDF document text
- https://mafupixalikufu.weebly.com/uploads/1/3/4/6/134662523/pogijalavedujotir.pdfIn PDF document text
- https://golizagizaziw.weebly.com/uploads/1/3/4/7/134701046/4656916.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/3c678f5f-05d0-4e38-81a8-28bd1e404889/how_to_install_cricut_expression_2.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/97c03a7f-3c7e-4e31-af5e-c2f5a64ff048/how_to_access_menu_on_orion_tv_without_remote.pdfIn PDF document text
- https://s3.amazonaws.com/safago/harga_samsung_tab_ce0168_bekas.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/194a7776-4266-4028-840c-4cf3826e600f/1697973660.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bb26d905-5f8c-475c-a851-c916c03d09be/que_es_un_taller_pedagogico_segun_autores.pdfIn PDF document text
- https://s3.amazonaws.com/zuwosil/belajar_chord_gitar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0e2fc751-068d-45ec-97a1-4d3543c16229/hypertherm_powermax_30_or_45.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/47c4df02-8f4f-4008-aceb-7b121fe1fb71/pinijidosiranojexo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/64a8a6ff-88ea-4dab-8717-cbe21fbc5865/hitchhikers_guide_to_the_galaxy_42_meme.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/71b1a57c-2879-48f8-b630-b337766ea325/75303779328.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dd77106b-08ec-4e06-b877-6ac4720bbe3a/how_to_fix_a_monitor_that_doesnt_turn_on.pdfIn PDF document text
- https://s3.amazonaws.com/lemefofutomapox/best_offline_shooting_games_apkpure.pdfIn PDF document text
- https://s3.amazonaws.com/tugumeb/construction_guide_osrs_runehq.pdfIn PDF document text
- https://s3.amazonaws.com/risalenefazozo/87507543582.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6f26fd03-eef8-4660-8406-a99ecee43da8/miller_bobcat_225_kohler_welder_generator.pdfIn PDF document text
- https://s3.amazonaws.com/jarawaxanivu/wpf_expander_template_example.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d05eb5bc-1b49-4b2c-8586-a48e7c0a2c33/memnoch_the_devil_quotes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/25369332-5c96-4fad-a7cc-bc9a7fc67483/65936287976.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00031af9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x31AF9	3568 bytes
SHA-256: `7bcad3f116e00a87878fcaafcbd96331733e68dabc5b66e87ba9eb2b757177f7`
`font_01_sfnt_off000327b6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x327B6	5460 bytes
SHA-256: `0718ecc5bcc04ee17bf087ac1659a0857d920a6f1af16ab22c66eb6ee8b84457`
`font_02_sfnt_off00033a43.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x33A43	14688 bytes
SHA-256: `41298bd90400c81e5c9793b82f9588d026a85e8c7eba7aa0248422e0653c01f1`
`font_03_sfnt_off0003678c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3678C	16684 bytes
SHA-256: `4cd55fee6c52bbab32ed20b0b25846bff407090075fa0ab45dc9808449a8eeb0`

Open this report in the interactive analyzer, or submit your own file for analysis.