PDF malware analysis — malicious · 329fd8602ee25f3e

MALICIOUS

PDF

77.3 KB Created: 2021-03-25 11:43:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 96bc886aa7ee435464ac1551d3462c5e SHA-1: 70096d273dc266fdb0000537a10cdd37a31629b9 SHA-256: 329fd8602ee25f3e323a5f58b38f20904c583e08f017b483019437561f86a333

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a secondary payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to a 'magic bullet cleaning kit'.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://dafemum.ru/strik?utm_term=magic+bullet+cleaning+kit
- http://uaregroup.com/guided_day_tours_from_rome_to_veniceqtjs4.pdf
- https://static.s123-cdn-static.com/uploads/4529087/normal_5fe0028ae9215.pdf
- http://nosinoski.shop/696574574839g3xv.pdf
- http://clientbluebadge.com/dari_ke_word_candyfipe8.pdf
- http://badge-verification-center.com/how_often_to_replace_samsung_refrigerator_water_filterc8ej4.pdf
- http://alteramaks.world/552395466891d0l7.pdf
- http://liketime.online/rixesumuligokex7ufb.pdf
- https://static.s123-cdn-static.com/uploads/4405202/normal_5fcede1a0cdfa.pdf
- http://pokypka.xyz/lolazosigutejubozoso0r7sg.pdf
- http://hackins.site/25309399159mc817.pdf
- http://stroy-level.ru/why_wont_my_element_tv_remote_worktygse.pdf
- http://chambre.xyz/subtraction_with_regrouping_worksheets_2_digit0szy8.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://s3.amazonaws.com/rebomedug/free_cursive_handwriting_worksheets_for_third_grade.pdf
- https://s3.amazonaws.com/najubu/94870668972.pdf
- https://20e8ec16-a7ca-487e-906f-4b2d5c2744e2.filesusr.com/ugd/ab81b8_48e372689de343c385647b8acf28f1f5.pdf?index=true
- https://d5fd0048-bb8d-45a1-ba21-28d1cb0b7162.filesusr.com/ugd/5e8de6_d2e6dfbf965b4f92bc3f331587e6a4c1.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e5cd.bin` `88309dec2d67567ed8463ac565b76b007931323dd8a448742ea1ba7ecf1e4aba`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE5CD	4676 bytes
`font_01_sfnt_off0000f5cb.bin` `dfa13d934a939678bb55d7eaf9b5d02d430c123863f51703823c5645f78ffc0e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF5CB	10260 bytes
`font_02_sfnt_off000118ce.bin` `0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x118CE	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.