PDF malware analysis — malicious · 7c74a3e192430216

MALICIOUS

PDF

1.01 MB Created: 2021-06-08 11:36:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24

MD5: bb411de118f97301938ca0d2cf104419 SHA-1: 05aacaf4a91c3ecb6b2301e808b5dc0182d19a13 SHA-256: 7c74a3e19243021642d50ce0e73f811adefc7c136ae5b681495b50dc121cd17c

66 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified by ClamAV as 'Pdf.Phishing.Trojan'. It contains an embedded URI pointing to a suspicious URL, 'https://irlanc.ru/pbw', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to a 'video status maker'. No scripts were extracted, but the presence of an external URI and the ClamAV detection strongly indicate a phishing attempt.

Machine Learning

Nyx PDF Classifier clean score 0.1112

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://irlanc.ru/pbw?utm_term=lovely+-+lyrical+video+status+maker+without+watermark PDF link annotation
- https://cdn-cms.f-static.net/uploads/4464734/normal_601eded85a2ad.pdfIn PDF document text
- https://zemejinifuv.weebly.com/uploads/1/3/4/5/134577925/f7e8d7bdbe6a.pdfIn PDF document text
- https://rororejiwep.weebly.com/uploads/1/3/5/9/135966539/ed308.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366628/normal_60ba6709c1a97.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4495855/normal_5fcb23e1968a4.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4425224/normal_5fc6ce1bf1a52.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4481280/normal_5fde5fba52b9d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4471513/normal_605bfcc5cc427.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4418970/normal_60627f49523ad.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4383915/normal_6007559303ede.pdfIn PDF document text
- https://xoravali.weebly.com/uploads/1/3/0/7/130775395/rozawamurebuduguxa.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4473645/normal_5fedd8ef5e52b.pdfIn PDF document text
- https://sizolofowexowar.weebly.com/uploads/1/3/5/3/135350689/d1f4876.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372101/normal_60b949f3dd323.pdfIn PDF document text
- https://sonikimejikelo.weebly.com/uploads/1/3/2/6/132681145/9aa5dc208db.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368474/normal_60bd3bf5e8221.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4499309/normal_5fda8229f1e3a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4375884/normal_603b11eb9f4ba.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/c8368f85-df64-46e5-bf4d-0b9bd4496d55/how_to_tell_a_chainsaw_chain_size.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eb6d0aee-7f8d-463c-877f-7eecd8af790e/siwoxuxo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cb45cfd3-3dbb-4005-9877-9864b7285059/85318208291.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/73bafee4-ebc4-4e6e-941a-2428820910e6/pakederovapemi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/38b009b1-bd42-4a77-9e89-f97615e5279b/how_to_read_welding_blueprints.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/50c33c26-4c78-470b-afbb-97a5d7f35cc5/47289526027.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a32dae30-e7e5-4181-beb9-145848758e1e/do_punching_bags_help_you_fight.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b6485c0f-cc0a-465c-9681-fb9aa33d3cf8/how_do_you_read_a_schumacher_battery_charger_meter.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000fa3ec.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFA3EC	8496 bytes
SHA-256: `f913e66b51ac0a681a866f9e865921154205f0f49d2c05f75c9003c756ccb896`
`font_01_sfnt_off000fbfb2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFBFB2	5468 bytes
SHA-256: `94f0b56a138fa582a6d51902b87811c055f47581e53fb101411725f41c600f86`
`font_02_sfnt_off000fd253.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD253	17500 bytes
SHA-256: `530ac25d155c51612b5a87f68663836bfb3a56f941b5f32707f645bb542df74e`

Open this report in the interactive analyzer, or submit your own file for analysis.