PDF malware analysis — malicious · 8dcc45dd580b8164

MALICIOUS

PDF

73.6 KB Created: 2021-05-04 11:44:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b941c0b72dac5d603ef8ae82cc01a366 SHA-1: d0fd09966ad8193b32e23023847b9c0b98fa17bb SHA-256: 8dcc45dd580b8164079654ab755c59d7248cc128bebb09687d1ac067beb180e0

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file, disguised as a crochet stitch guide, contains an embedded URL that leads to a malicious domain. This suggests a phishing or social engineering attack aimed at redirecting users to a harmful site. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for credential harvesting or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9991

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/strik?utm_term=free+printable+crochet+stitch+guide
- https://cdn-cms.f-static.net/uploads/4408881/normal_606e5eaebe584.pdf
- https://static.s123-cdn-static.com/uploads/4493891/normal_5ff3b5cbec51a.pdf
- https://cdn-cms.f-static.net/uploads/4405437/normal_6015ada4c8ce7.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/a097acee-f288-4f3c-925e-d849a3b069ed/90543574338.pdf
- https://uploads.strikinglycdn.com/files/54ffdf19-7d0b-4ed4-9e1d-123536af8fdb/53562524195.pdf
- https://s3.amazonaws.com/gewisetug/fax_cover_sheet_with_medical_disclaimer.pdf
- https://s3.amazonaws.com/boduxatavepe/52134152253.pdf
- https://uploads.strikinglycdn.com/files/9116ab70-e5a5-493e-9f4e-92c72e9525c1/the_revenant_book_summary_sparknotes.pdf
- https://uploads.strikinglycdn.com/files/0b14668a-714f-499e-a469-568bbe0ef5b7/bopodanukiloxiviragep.pdf
- https://s3.amazonaws.com/fupanabivote/google_sheets_desktop_shortcut.pdf
- https://s3.amazonaws.com/gitipelut/avid_media_composer_6_mac.pdf
- https://s3.amazonaws.com/jivala/age_of_empires_3_free_mac.pdf
- https://s3.amazonaws.com/julexekubaj/persuasive_essay_topics_for_middle_school_students.pdf
- https://uploads.strikinglycdn.com/files/d42301e4-9795-4bd3-b1cd-d46ee1e32992/crown_xls_2000_used.pdf
- https://uploads.strikinglycdn.com/files/a8b30aa4-89d2-4c4c-9c45-4f3297e97e76/69730536090.pdf
- https://s3.amazonaws.com/wakuzidi/66309080250.pdf
- https://uploads.strikinglycdn.com/files/dc1f24ca-18e3-48cc-89a5-d28d308e5e9e/39053208898.pdf
- https://uploads.strikinglycdn.com/files/570cb175-adbc-454f-a0b8-b3e58119ad51/95464752022.pdf
- https://uploads.strikinglycdn.com/files/f8db0586-c197-4cdf-aeaa-c91bae5e0f43/moribigigevi.pdf
- https://uploads.strikinglycdn.com/files/f9ac3c84-7034-4654-90bb-7ca2761ed825/gufekibosilu.pdf
- https://s3.amazonaws.com/dobikasukavu/ff15_pc_performance_guide.pdf
- https://s3.amazonaws.com/dotivaf/wuzokorasutugeden.pdf
- https://uploads.strikinglycdn.com/files/a00b72a0-ddec-490d-a4cc-076fa39fbec3/line_6_pod_x3_pro_presets.pdf
- https://uploads.strikinglycdn.com/files/281fb54e-b91d-45fb-ab2b-9a0cb7af694a/troubleshooting_lg_fridge_ice_maker.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e2d4.bin` `90620ec455b5489dfb2f6f073ef1adddb211a00d782d734a4096d6ddd4b75987`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE2D4	5432 bytes
`font_01_sfnt_off0000f538.bin` `e15478e9518dee53d72b6c73286cb9b9e61929584b969c1f46bcdca19d43da12`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF538	10368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.