PDF malware analysis — malicious · 3d3be35e1c0ce54a

MALICIOUS

PDF

89.9 KB Created: 2021-05-15 14:59:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25

MD5: 9de300e868a67eba625110968845c9b8 SHA-1: e1edcb99adba62ea452b84bb6abc9af9235c145a SHA-256: 3d3be35e1c0ce54aef107d9f2a793ac524c62987f326497834ff836fa9fdc2be

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'https://crophysi.ru/strik?utm_term=can+i+use+procreate+pocket+on+ipad'. This URL is the primary indicator of malicious intent, likely serving as a lure for phishing or to download further malicious content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9989

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crophysi.ru/strik?utm_term=can+i+use+procreate+pocket+on+ipad In PDF document text
- https://cdn-cms.f-static.net/uploads/4372384/normal_605120447d6b3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374545/normal_60579e50f2cf8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4407664/normal_601adba07ee87.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4384642/normal_5fc8311b88328.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4495849/normal_6042ec0c89ba1.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4450259/normal_5fdefa198bf32.pdfIn PDF document text
- https://cdn.sqhk.co/lipisedopila/rvhehag/peguguxorere.pdfIn PDF document text
- https://cdn.sqhk.co/zetuzire/6hcgehh/anthropometric_measurement_techniques.pdfIn PDF document text
- https://cdn.sqhk.co/nizaveni/lpohcQj/shogun_rua_vs_paul_craig.pdfIn PDF document text
- https://cdn.sqhk.co/kojagopomon/fjaH8lx/lesson_2_classifying_matter_answers.pdfIn PDF document text
- https://cdn.sqhk.co/soxesemu/jahjjim/16427050855.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4446782/normal_5ffb5054799f1.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4467005/normal_5fcc4526ec6a7.pdfIn PDF document text
- https://cdn.sqhk.co/tokititagiwe/h65tThh/empire_total_war_politics_guide.pdfIn PDF document text
- https://cdn.sqhk.co/vixukose/3oGlchQ/aesthetic_wallpapers_laptop_blue.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/zaxawetawupo/transport_processes_and_separation_process_principles_4th_edition_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9d6cba57-3c2f-449f-86e5-614149a3c8bf/tesla_model_3_standard_range_plus_price_in_canada.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d4b24670-c911-41e1-b9a1-1bc496644416/mumotuvaxewafupo.pdfIn PDF document text
- https://s3.amazonaws.com/forupokisip/truck_waybill_format.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cfbc729a-d003-4051-9a02-43fe3948d062/ill_be_gone_in_the_dark_tv_show_nz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/07ee784f-4ecb-4b4f-86ea-74a89e97fb77/what_is_the_point_of_waste_recycling_plant.pdfIn PDF document text
- https://s3.amazonaws.com/zugutixe/50541772382.pdfIn PDF document text
- https://s3.amazonaws.com/rizezobabub/how_to_become_a_carpenter_in_california.pdfIn PDF document text
- https://s3.amazonaws.com/xujitezu/where_does_unity_download_assets_to.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010b61.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10B61	5004 bytes
SHA-256: `d9a71be32411c28aa350c0db3101633fae85a721bd96f7b0417ca4407b2a88ad`
`font_01_sfnt_off00011c6f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11C6F	11656 bytes
SHA-256: `3814ee753dfe8559251b62d21663813ce0a893552149cac4caf3684169273001`
`font_02_sfnt_off0001443d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1443D	16168 bytes
SHA-256: `3753bffb8877ea40fa0e96c2d0711e4dd70c5d14f98bd0b9fe0a0a4777fe19d2`

Open this report in the interactive analyzer, or submit your own file for analysis.