PDF malware analysis — malicious · 8a8a6ced7163f0cd

MALICIOUS

PDF

77.9 KB Created: 2021-02-13 05:53:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 717349935e866be961d43807628eb918 SHA-1: 422558148e0221069c5f6597abeadde41887b914 SHA-256: 8a8a6ced7163f0cdfa73c8b17d56900aed9cd0b16f93bc7ef0acc6470aa335ef

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that masquerades as a game leveling guide, likely intended to trick users into clicking it. No scripts were extracted, but the presence of external URIs and the ML detection strongly suggest a phishing or malware delivery attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://bologen.ru/wix?keyword=blade+and+soul+hm+leveling+guide
- http://babbieshop.ru/inclined_plane_simple_machine_gizmo_assessment_answers8c7db.pdf
- https://cdn-cms.f-static.net/uploads/4479441/normal_601d7d41bf43e.pdf
- http://najitop.22web.org/nafewomin.pdf
- https://cdn.sqhk.co/negixakozaxu/0wz4VlS/vogek.pdf
- https://cdn.sqhk.co/jaxugaveg/iiiuUij/hit_color_ball_3d_painting.pdf
- http://efarbok.xyz/update_gradle_android_studio_ubuntu8b51b.pdf
- https://cdn.sqhk.co/zidexamuwela/Ux8Hid5/lanababe.pdf
- http://milanomoda.site/loselirukamutuwutadixi4kpot.pdf
- https://cdn.sqhk.co/jivazufevi/fghehSX/maditenewujipaguduvoneduk.pdf
- https://cdn.sqhk.co/kagurase/pihYpii/tagevewos.pdf
- https://cdn-cms.f-static.net/uploads/4402533/normal_5fe9f1ba8c5b4.pdf
- https://cdn.sqhk.co/vabedesi/i72O7eZ/zufekabadabifusegiga.pdf
- http://portkamesto.site/552450642605iup6.pdf
- https://cdn.sqhk.co/limizolaxa/d8ghh5V/84510309476.pdf
- https://cdn.sqhk.co/pidenali/njayU9u/bendy_model_blender.pdf
- https://cdn.sqhk.co/tamoravuwera/hjhfUig/beporejasedesudavuwagal.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://sozanizitug.epizy.com/karex.pdf
- http://kazaxese.epizy.com/balance_sheet_template_for_small_business_xls.pdf
- http://jexamovofu.epizy.com/length_conversion_worksheet_grade_3.pdf
- http://vuruwabudakase.epizy.com/postman_quick_guide.pdf
- http://ramejepazino.rf.gd/laundromat_business_plan_sample.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f504.bin` `1f4fe61959f4abda77c48ec0ba496886cfd7ca35baac022a73c11bdcc56641cd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF504	5252 bytes
`font_01_sfnt_off000106cb.bin` `a80ace0e94ad031954b12ea1dafceaa22f03d3390fc6b7333ce7bbb86dce1e53`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x106CB	10212 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.