PDF malware analysis — malicious · 4de33aa0c7b3e687

MALICIOUS

PDF

80.2 KB Created: 2021-06-09 02:30:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24

MD5: 2c81c7ebc81069f63c603bee3bcb8720 SHA-1: ceb18998a473de537e533ef1360c8343eb154b1b SHA-256: 4de33aa0c7b3e687eab8ce52b50ea10ff554cd36e6b3d8f98f44517dfc8d8887

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. The embedded URL 'https://nomylo.ru/pbw?utm_term=download+followers%252B+mod+apk' strongly suggests a phishing attempt to trick users into downloading a malicious application. The document body, though heavily obfuscated, contains text related to downloading 'followers mod apk', reinforcing the phishing lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nomylo.ru/pbw?utm_term=download+followers%252B+mod+apk PDF link annotation
- https://cdn-cms.f-static.net/uploads/4501356/normal_602421da3cef8.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4446285/normal_6002849d2777c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4490516/normal_6069f18c9c11f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4470401/normal_606007a03dd1a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4416326/normal_60438e5531d81.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4480149/normal_6066d3fce966a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4485153/normal_606e188e8ef3c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369664/normal_605f7e645b36b.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4485718/normal_600134f533285.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4447437/normal_5fe041ef24afd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4370076/normal_6024f26235d05.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4394060/normal_601595c01dbd2.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://dadilotofexi.pbworks.com/f/sajowodomekozuweperuwajo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6854a29c-8adf-4c1a-8774-d8e89f4e830f/do_turtle_beach_recon_200_work_on_xbox_one.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/22911bde-dee6-43e1-8759-c3f2b594f0d8/calculate_mean_median_mode_standard_deviation_variance.pdfIn PDF document text
- http://betifabito.pbworks.com/f/how_to_introduce_yourself_to_a_customer_in_an_email.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a1b9d60a-4187-4932-bd92-8f5ef132afc8/punolasukesozof.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c4d82757-eddc-499c-b154-a368e924d266/how_to_get_started_in_music_industry.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/07e3bb8d-22cb-4934-8f84-f11c91d48470/which_programming_language_is_used_for_arduino.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f987520c-8339-453b-b858-873c57ed7d6f/how_to_find_the_speed_of_an_object_when_it_hits_the_ground.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d9ae979f-720e-4099-8e28-ca1a05954dac/wordpress_themes_food_blogger.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f4ef9349-2f7a-402b-a33c-e9f4fe17763a/who_dies_in_mortal_engines.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5d43ca60-0014-4907-9207-5b7530b9fb60/diablo_3_season_22_builds_bluddshed.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bd1765d1-ef09-4d1a-8891-baa507d6e7b3/31297258978.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ef98.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEF98	5004 bytes
SHA-256: `4fde2cd76a01caab81f9e554de6c65aeeef16258cacd2ca87b316434906d4ebf`
`font_01_sfnt_off00010091.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10091	10700 bytes
SHA-256: `a349dc4700febf479dc1d6ff44429c3d0631a2401027640b3f7ad59e49776e54`
`font_02_sfnt_off00012525.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12525	4324 bytes
SHA-256: `cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34`

Open this report in the interactive analyzer, or submit your own file for analysis.