PDF malware analysis — malicious · 483ecfe58f3c2862

MALICIOUS

PDF

82.0 KB Created: 2021-03-25 04:23:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 22414dfec01ff34468ea862ca18aa9db SHA-1: a1d101cbd3edaccd1f59824d1061f3b61d9f52b8 SHA-256: 483ecfe58f3c2862bd05332773bce6803d3099b2661f8098e11c95475b4f612b

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, suggests a lure related to 'approval addiction free pdf', likely intended to trick users into visiting the external URL for malicious purposes.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/award?keyword=approval+addiction+free+pdf
- https://cdn-cms.f-static.net/uploads/4405443/normal_5fd98e9be6c06.pdf
- http://wijutomotagam.mypressonline.com/data_analysis_report_sample.pdf
- https://cdn-cms.f-static.net/uploads/4504047/normal_6022d8cd88a3e.pdf
- https://cdn-cms.f-static.net/uploads/4456666/normal_60556bf2d3d8a.pdf
- https://static.s123-cdn-static.com/uploads/4365608/normal_5ff8f6dff1d60.pdf
- https://static.s123-cdn-static.com/uploads/4405440/normal_5fe0c069ce2e9.pdf
- http://zijozarub.mygamesonline.org/89490077754.pdf
- http://dejivuxa.mygamesonline.org/goduvugutosukoli.pdf
- https://static.s123-cdn-static.com/uploads/4474720/normal_5ffa4e91c81d3.pdf
- https://static.s123-cdn-static.com/uploads/4467300/normal_6005fa3907d94.pdf
- https://static.s123-cdn-static.com/uploads/4492546/normal_5fe342ecb4e8a.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://wuzuwoxijotefik.epizy.com/18841160966.pdf
- https://s3.amazonaws.com/fisulefajow/zijukezisoseni.pdf
- https://s3.amazonaws.com/wekibik/mercedes_rear_seat_entertainment_system_2014.pdf
- https://s3.amazonaws.com/wazotojemov/the_scientist_coldplay_piano_sheet_music.pdf
- http://ditufadupogeju.epizy.com/62395893660.pdf
- http://siwemoxoxawevuv.atwebpages.com/tanesafowevifeno.pdf
- http://releboxodaw.rf.gd/red_whatsapp_2019.pdf
- https://s3.amazonaws.com/bededuxotulapil/tufarinenutewosab.pdf
- http://derajovaku.rf.gd/66029028031.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001039e.bin` `070cf64f8edc284c7e3a5ee3f37dc67a0a2c1da2862f9e5e2582b0a176eb1ffc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1039E	5020 bytes
`font_01_sfnt_off000114cc.bin` `97a19f34b8f0d5b4b3839460603bf7843c00ec69bafb3404ae7323fb03177b6c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x114CC	11056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.