PDF malware analysis — malicious · 6e3e81968e682d11

MALICIOUS

PDF

77.3 KB Created: 2021-04-17 10:58:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 418e4ac8246b6c4c7326fa2669ab4479 SHA-1: e2fbf51fbedb9433418c9cf6a2338e77a78d7965 SHA-256: 6e3e81968e682d1117d3edc5ffde7664f85c9fee32d1b42755184ce34f67b8bf

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL that directs users to a suspicious domain, likely to deliver a secondary payload or phish for credentials. The document body, though heavily obfuscated, contains keywords related to an error code, suggesting a lure to trick users into clicking the malicious link.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/strik?utm_term=sunbeam+electric+blanket+error+code+f1
- http://mavpa.fun/69094240391y622x.pdf
- http://verenica.net/53649912374w23pq.pdf
- https://cdn.sqhk.co/fepebage/bI2qjil/69870479078.pdf
- http://pupilobasam.iblogger.org/boogie_wonderland_marching_band.pdf
- https://cdn.sqhk.co/jezuleku/oiiibs5/39334702815.pdf
- https://cdn.sqhk.co/bemaxopig/fXYibjd/62532497276.pdf
- https://cdn.sqhk.co/jizapamilizo/3gh4bjb/linen_cabinet_with_drawers.pdf
- http://tesar-krd.ru/java_arrays._fill_performancex0j1j.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- http://detotoga.epizy.com/joviv.pdf
- https://s3.amazonaws.com/jebupofedijakuk/82584031887.pdf
- http://xalanijowule.rf.gd/allerseelen_strauss.pdf
- https://s3.amazonaws.com/tubupejevomo/83790591316.pdf
- https://s3.amazonaws.com/bulujono/dimewikabefe.pdf
- https://s3.amazonaws.com/xoguwavosuje/sklearn_classification_report_macro_average.pdf
- http://xoxasosopu.epizy.com/77669368802.pdf
- https://s3.amazonaws.com/pazovugal/book_binding_manual.pdf
- https://s3.amazonaws.com/sigobija/game_hyperburner_mod_apk.pdf
- https://s3.amazonaws.com/bededuxotulapil/virasanadowaxu.pdf
- http://pelapekowom.rf.gd/87006186192.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e31a.bin` `95f72b1e5b97835c2a1fe55db160ef0be8165440717733baa26215d3b89f57c2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE31A	5228 bytes
`font_01_sfnt_off0000f4c6.bin` `7482ac524cb3e148b5e6c5f9d6e757ecc9712a6dbf2fca2bad4d7d61597d23c7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF4C6	10832 bytes
`font_02_sfnt_off000119a4.bin` `d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x119A4	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.