PDF malware analysis — malicious · 317c2deaebac8c24

MALICIOUS

PDF

86.8 KB Created: 2021-06-06 03:58:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18

MD5: d6c34c56f91dfd344268a4423723f331 SHA-1: b60525e1620d0ce68ee37093025e3f5be414e3e4 SHA-256: 317c2deaebac8c249c37a908e3eae006cba93a47a492527958338f01516b2eea

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/123?utm_term=faceit+anti+cheat+windows+7 PDF link annotation
- https://cdn-cms.f-static.net/uploads/4485587/normal_606b378a023b9.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4422643/normal_5fee8696456b6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450890/normal_603e44efd7387.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4414866/normal_604de2e8cfc56.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4410703/normal_5fe27997e8ce9.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365567/normal_6025b43b69cb1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4492278/normal_602a43f0e512a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413850/normal_6027688ea4244.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4402707/normal_6065dd4013a7f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4497082/normal_5ff7913ab0e75.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371523/normal_605b6b3834368.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418987/normal_603cfa8ae30f8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4423732/normal_6013a086afd0f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/7b77e6d1-fa3c-4171-ba65-e10ae30fde03/xixazarukobikalutabuz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/695ad918-933a-4e57-bea2-f3cb9f897c92/what_does_code_error_e_mean_on_a_honda_odyssey.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/929b432b-8480-466b-8957-4134af069c63/lekawopegozobumutatizenu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fb9e5d0c-ef43-4242-a8fb-3fe4358e3037/hp_folio_9470m_elitebook_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ac5387d7-7121-4f48-9cb0-93398a28ffa2/tujuparewidukokivezag.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5d29da30-50d6-42b8-a597-eaa3f6d2bf3d/the_book_of_thoth_first_edition.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c449c31e-f2fc-4a18-af30-41ad338e5d0d/nisenijanexipolak.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dee20c1a-2e6a-4a97-b322-e11db30e9537/nazujemarapowaxep.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e5ed75c6-5865-488f-9e1c-9a1544413816/6292843030.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bc0451a2-4343-444c-8de5-0ca7ad4ad570/redomurepagopapew.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f1ce.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF1CE	5024 bytes
SHA-256: `4713f06aa0c7773954055b639170149d17737e20b40ca8c993d9a374236480a9`
`font_01_sfnt_off00010301.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10301	22760 bytes
SHA-256: `d04992399d8c6870af95738e9dcf8fb12630a8a7076e494c508400f61d00259f`
`font_02_sfnt_off000135f4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x135F4	16376 bytes
SHA-256: `bc7e3f6831be34686de02ce7be2a06b9f1fa2b1a298201cd6e3dc3baf4672bf7`

Open this report in the interactive analyzer, or submit your own file for analysis.