PDF malware analysis — malicious · 52ef18f24019cae8

MALICIOUS

PDF

93.4 KB Created: 2021-05-31 04:48:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25

MD5: 4f438467f5ff8387bd5f73ba30719e41 SHA-1: e9d9267e8d51343afdb74a3fe8ced0a650d34f3f SHA-256: 52ef18f24019cae803339d08dd156fff8473710395388642f66720d2181b635b

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that, when clicked, directs the user to a suspicious domain. This domain is presented in a way that mimics a search result, likely to trick the user into downloading a payload. The ClamAV detection and ML classifier strongly indicate malicious intent, consistent with a phishing or malware distribution tactic.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xezojetit.ru/strik?utm_term=jillian+michaels+30+day+shred+level+2+download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4449605/normal_6035d98769e42.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4447265/normal_6062a8d6d2b1a.pdfIn PDF document text
- https://static.s123-cdn-static-d.com/uploads/4444114/normal_60afffa9a52c4.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4446380/normal_60290c00ad1cc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453540/normal_5fd76c47b0b84.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4422645/normal_6066c2c156d52.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4445550/normal_60257566f1716.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408719/normal_60488a2c288ad.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4488822/normal_600f36da7f969.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/a289648b-c0af-4cee-9535-1e3a2a465fdf/how_do_i_make_an_inventory_spreadsheet_in_google_sheets.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f33f2121-ae49-4156-b898-90cae00e0a1e/creators_the_past_uscita_dvd.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3c320994-e51a-4e43-a91f-ae114dfcf48b/beamng_drive_apk_iphone.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4a43af4f-9b27-4fc3-b4f6-0a9cc6c0d60b/25489640973.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aa514e04-e55a-4b8d-a21c-28691674d2cc/crossword_puzzles_la_times.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c5a9a16c-e62c-43b7-937a-52a0793d096d/rotebezifozolurajuvi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/66dedef0-f24e-420b-9f66-7cd841b6c30d/how_to_turn_off_captions_on_a_sanyo_tv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b25ab696-63f7-4ccf-8c40-200b3e0b6a86/vivajagotiparogezirojor.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e98baecf-9dbb-4f27-8dbb-39c609b9e504/how_long_does_domestic_priority_mail_take.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2be6fc0d-6dd1-40cf-92f7-6fa551e0d3b3/how_does_a_tractor_dynamometer_work.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/616a20db-7e17-463b-af91-856b26c69b39/dr_seuss_books_collection_amazon.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/081ab4ea-0eb3-4f50-8e4f-b298ad57332f/harman_kardon_hk695-01_subwoofer_multimedia_speaker.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd6ceaaf-35d7-4025-90c9-080f658d69a4/fire_next_time_kjv.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000108dd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x108DD	5860 bytes
SHA-256: `f8137c6bf27a4665bcd17495a8baba58ee70f752ce783d379232039bc77c6030`
`font_01_sfnt_off00011cab.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11CAB	2828 bytes
SHA-256: `4a69130a24d70a05c24a56ea58270101cff10449e326bad8ebc99f3af0cac73e`
`font_02_sfnt_off000128b6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x128B6	11556 bytes
SHA-256: `654dea1384cf2889def162364eaa1c0df7dea891b43ff3fddaee229806cbe442`
`font_03_sfnt_off00014ef7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14EF7	16692 bytes
SHA-256: `b062bc3d0cd32b296bac1d6b1145e1832a6a8db5553c039118eba25248f7da67`

Open this report in the interactive analyzer, or submit your own file for analysis.