PDF malware analysis — malicious · 3c466f410995736d

MALICIOUS

PDF

76.3 KB Created: 2021-04-02 19:31:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 40f91c57aa77057c092a5f836d2839cc SHA-1: d12f174c9e3dd95b450ccac83de2f7a0f2caf43e SHA-256: 3c466f410995736dbf5c3502485cd6a37745e4654dca1df74126ad5f21a06243

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'https://jumiwimov.ru/award?keyword=acrobat+reader+merge+pdf+free', which is likely a phishing lure or a download site for further malicious content. The document body, though heavily obfuscated, suggests a pretext related to PDF merging tools.

Machine Learning

Nyx PDF Classifier malicious score 0.8035

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jumiwimov.ru/award?keyword=acrobat+reader+merge+pdf+free
- http://gladkoe-telo.xyz/foodsaver_v2490_problemsgcoc5.pdf
- https://cdn-cms.f-static.net/uploads/4477373/normal_601bfac23587f.pdf
- https://cdn-cms.f-static.net/uploads/4488090/normal_5fd84db5b230f.pdf
- http://spoonnumberone.xyz/what_eats_lanternflies_in_asiawbkod.pdf
- https://cdn-cms.f-static.net/uploads/4416143/normal_5fdc17fc7dc7a.pdf
- https://cdn-cms.f-static.net/uploads/4467912/normal_600a591621729.pdf
- http://mscgis.net/konosuba_light_novel_indonesiarbwgb.pdf
- https://cdn-cms.f-static.net/uploads/4369509/normal_600db41a7822d.pdf
- http://wersita.space/bizurevilaliluloh6rf6.pdf
- http://hs-life.ru/robertshaw_9400_thermostat_troubleshootingoivhs.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/87fe35a1-dd79-4fc6-afee-2f7f92cd2d9e/tuburufaworenitabidomova.pdf
- https://s3.amazonaws.com/vavabi/magpump_.223_5.56_ar-15_polymer_magazine_loader.pdf
- https://uploads.strikinglycdn.com/files/e47f1dfb-30d3-4cd2-9e9a-968634a3af48/15671313988.pdf
- https://s3.amazonaws.com/kigavanus/minecraft_1._5_2_windows_8.pdf
- https://s3.amazonaws.com/patilawasu/the_outsider_series_synopsis.pdf
- https://s3.amazonaws.com/sefiwegegagu/posufatuwexafa.pdf
- https://s3.amazonaws.com/nigimul/nisadokebukiwabotob.pdf
- https://s3.amazonaws.com/woxewiwupir/xojakosutamunumabib.pdf
- https://uploads.strikinglycdn.com/files/2de41948-7b27-4655-9de2-50d31c9e26ee/padonoratebavevigekukime.pdf
- https://uploads.strikinglycdn.com/files/0a0eaf99-0291-4464-972a-aff009900b5a/xetixapusatiwanasimevota.pdf
- https://s3.amazonaws.com/foneniz/gumowi.pdf
- https://uploads.strikinglycdn.com/files/8b8dbc9b-f475-4edf-a809-1ac5770e77a2/toyota_camry_2018_tyre_size.pdf
- https://s3.amazonaws.com/vebenok/coordinate_geometry_proofs_cheat_sheet.pdf
- https://s3.amazonaws.com/mozedijiz/33166624201.pdf
- https://s3.amazonaws.com/vatosolikijike/how_to_clean_xbox_controller_battery_pack.pdf
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f9d3.bin` `564d760864f132a7496d20c351674f89dacc5eca944c5726f01847eccd3e2a36`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF9D3	5392 bytes
`font_01_sfnt_off00010c16.bin` `fba8905a4a7dfcdea3e18725f92741f4c1a7ee644366a00cdfe47ec84cc400ce`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10C16	11140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.