PDF malware analysis — malicious · 7a63509eacd411b3

MALICIOUS

PDF

77.5 KB Created: 2021-06-01 03:53:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26

MD5: c69e5b4eb656d581484954b7d85ac9d7 SHA-1: a72a08fbb4c1df97b144d32c713fb561523d2753 SHA-256: 7a63509eacd411b3b8c086fab26c4447ea8d77a2bf866300422da62301d5c28e

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified by heuristics and a machine learning classifier as malicious. The document body, though heavily obfuscated, appears to be a lure related to a game, likely intended to trick users into clicking the malicious link. The presence of the external URI and the high ML score strongly suggest a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9991

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crewmak.ru/pbw?utm_term=how+to+delete+a+map+in+piggy+build+mode PDF link annotation
- https://static.s123-cdn-static.com/uploads/4366976/normal_5fe44e8234f35.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453336/normal_603f18709fbb0.pdfIn PDF document text
- https://static.s123-cdn-static-d.com/uploads/4482215/normal_60b50c8be8731.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4453332/normal_605c340d7534a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.opentle.orgIn PDF document text
- https://uploads.strikinglycdn.com/files/002cdc3c-f76f-430c-b045-6bad65275e5b/who_are_the_twins_in_the_movie_the_shining.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ec8ed6df-b0ee-452c-8d28-691e7ac24b03/azar_basic_english_grammar_ppt_presentations.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f28b723b-673f-481f-b010-3b56e361ebe5/memekirijivezutenekij.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2f4d096f-b3b8-43bc-b2cf-77d83d275514/what_is_negotiable_instrument_act_1881.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2fa7d685-10f3-4b7e-b1a4-c592dffc564b/pretty_little_liars_the_perfectionists_cast_season_1.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3bf548de-cc54-4331-ac3a-8141cd472d38/how_to_charge_i7s_tws_airpods.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/00d362d7-8575-4ef8-b85a-66733c988b28/xuvos.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/869c2805-336a-44a6-97d0-f40013ec205f/rcbs_rebel_master_reloading_kit_for_sale.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5453c0d3-5118-4901-a796-d1ae2a21cc4c/revilebalufomipodan.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/183078f7-a95c-4197-919b-4a59f6e2706a/how_do_you_know_if_it_is_acid_rain.pdfIn PDF document text
- http://zegugas.pbworks.com/w/file/fetch/144411423/taboo_midnight_card_game_rules.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a7e07e11-9139-4818-862e-c732cc234cc1/muslim_baby_names_free_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/35820e6b-d4d3-48a9-9901-0cd4d332d473/2010_ktm_300_exc_owners_manual.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/75dda23e-a330-40e8-b318-5d4b345f3ed7/90961931050.pdfIn PDF document text
- http://kolasotosexu.pbworks.com/f/sipigafe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/93578f1a-5cd8-41ea-9019-80a16bcdb3a0/77182125561.pdfIn PDF document text
- http://sepaxebi.pbworks.com/w/file/fetch/144417360/lenovo_google_account_bypass_apk_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/940c8a78-3e4a-4857-9b05-2c7412c7d4a8/emulateur_ps3_pour_android_apk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d4a34d21-5913-4e62-9bd2-924534c66cca/37691244871.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e374.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE374	5300 bytes
SHA-256: `3d1ff1e6d8258855529d07b5bf9154c614f921d845af1ee15bb8b6e55a8e7223`
`font_01_sfnt_off0000f576.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF576	6148 bytes
SHA-256: `488ffee5e9c33bcc1f3f00aec749f35977d0cdd209ffadaee35194d66ecc177d`
`font_02_sfnt_off00010556.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10556	10124 bytes
SHA-256: `1d3094f7736ef776d5a777c49983a31a8d6efd16c2ff38ee0546e2399fdd2b0f`

Open this report in the interactive analyzer, or submit your own file for analysis.