PDF malware analysis — malicious · 88df87c40c83e2eb

MALICIOUS

PDF

76.5 KB Created: 2021-02-25 02:03:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18

MD5: 7bf63b664898e200ef6d61c3b0f1619b SHA-1: 4302152cb39ebeb4b14b68b9525e1388299fbc4f SHA-256: 88df87c40c83e2ebc18f63419e6ef9f9542b2f7686d0ce4dc5e70bf6d7f98e41

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/strik?utm_term=is+procreate+app+available+for+android PDF link annotation
- https://cdn-cms.f-static.net/uploads/4475997/normal_601ac493387b7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4459164/normal_5fc93dee964d8.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4417325/normal_5fdd929325f62.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4491450/normal_5fdc189ae94c4.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4449392/normal_6002bce8ecfb2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4450139/normal_600dfdad7e883.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4448724/normal_601480d208189.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/viwoxuz/bodokel.pdfIn PDF document text
- https://s3.amazonaws.com/rilexazejuzovep/padazebudozijumafabasago.pdfIn PDF document text
- https://s3.amazonaws.com/lanubili/83436276579.pdfIn PDF document text
- https://s3.amazonaws.com/suzujewa/47006433862.pdfIn PDF document text
- https://s3.amazonaws.com/jipowumat/what_did_the_bobo_doll_study_show.pdfIn PDF document text
- https://s3.amazonaws.com/sisaxu/sufedederexat.pdfIn PDF document text
- https://s3.amazonaws.com/vapelurowar/31519009599.pdfIn PDF document text
- https://s3.amazonaws.com/palevijuj/broadmoor_elementary_school_uniform_colors.pdfIn PDF document text
- https://s3.amazonaws.com/vexeliku/hiv_genotype_testing_guidelines.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000edab.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEDAB	5288 bytes
SHA-256: `cdba51fba3ad7c7cd118d3ae8b43aae40c850b5036045da4c97e4f6fe4927204`
`font_01_sfnt_off0000ffb6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFFB6	10980 bytes
SHA-256: `9f7f06fb9eac498cdf0df01a31b838c8e10aed7c04dcaf5753cb34ec1cfde57f`

Open this report in the interactive analyzer, or submit your own file for analysis.