PDF malware analysis — malicious · 283e494b72c32e95

MALICIOUS

PDF

84.2 KB Created: 2021-05-25 14:10:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23

MD5: 8f0476af8613eb5fb89faa5d86bcff1d SHA-1: 984193815ed65192f85afa39af5dd47511dbc64f SHA-256: 283e494b72c32e959d4b4c1621333b49262ad7fdfda2f00ec45e895fd88167d3

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://zajinet.ru/strik?utm_term=download+patch+pes+2013+terbaru+2019+kuyhaa PDF link annotation
- https://cdn-cms.f-static.net/uploads/4379973/normal_6025bbe605c68.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4482218/normal_5ff78a296551f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366980/normal_6017ccb8cc978.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4491148/normal_605a27faeb811.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4454171/normal_5fec09273085e.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4418746/normal_5fee059b31cab.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4492580/normal_603703a1d5e7d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369304/normal_6020d87e06c49.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4468554/normal_605f8e027a36d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4421960/normal_600a6649cfe07.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/92d406ba-2ccd-430e-b359-0a189da28a76/2017_chevy_malibu_led_tail_lights.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/913e7be2-3623-4871-8d18-5076b9e23a82/jaxojizodavezemaku.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c74e884d-aa27-4c92-9513-24370f35ceeb/mubuweja.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2b15dc25-e331-4adf-a360-1dd408c0238a/bersa_thunder_380_laser_grips.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b1067b4d-1f53-40bd-8009-5ddb8e7aaa80/fuvavizusigivanafef.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/78fc0a29-2ea9-4ee4-bd4e-edfc8cf75dbf/nopaxogel.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/587262c0-07c4-4240-a519-a05653bf1f49/biwuxaporusilawupuniwevu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f83585a1-1ce3-4757-b0ac-add4c1c6c361/electrical_engineering_books_for_1st_year.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f6880c11-e167-46df-a354-8ac8dc8370c3/roadtrek_simplicity_owners_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eb800cc0-f9da-422d-b46e-c3270d89c37f/what_are_some_professional_growth_goals.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b32a40cf-7404-4dbf-a4b9-78b666145949/brandsmart_miami_gardens_phone_number.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/13a4591b-9818-456b-824c-64af10c8baef/7411161169.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/549f0fef-62fd-4f1f-be69-e71b447b4bb2/raselumi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f6af.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF6AF	6036 bytes
SHA-256: `43b28e1725a40562f1008743ff99fddf384922fb61b45b5bb83d282dc19e98ab`
`font_01_sfnt_off00010b44.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10B44	11588 bytes
SHA-256: `08b22e4bf837ffd7dcf64165415abe2e4ce53f591bf88d9832afbda2f5f6f458`
`font_02_sfnt_off00013321.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13321	4324 bytes
SHA-256: `1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361`

Open this report in the interactive analyzer, or submit your own file for analysis.