PDF malware analysis — malicious · 971140dcf4ff2fb6

MALICIOUS

PDF

72.8 KB Created: 2021-03-28 11:44:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7f4e133719943702ef25dca6d7c663ff SHA-1: dc4fa675e724fc0eb6ecd885b29f81d2795d4b53 SHA-256: 971140dcf4ff2fb600db12bca1f0fac05b901377c6d4dbd6abb71ec8655f7bdc

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a lure related to a 'mailbox' product, consistent with phishing tactics.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://dafemum.ru/123?utm_term=boite+aux+lettres+normalis%25C3%25A9e+grand+format
- https://cdn-cms.f-static.net/uploads/4486982/normal_6035e9381786f.pdf
- https://cdn.sqhk.co/vuvesanap/Jfgi7ii/vobubirenos.pdf
- https://cdn.sqhk.co/zijigemeworu/mUhfGAd/clash_for_dawn_guild_wars_mod_apk_download.pdf
- https://cdn-cms.f-static.net/uploads/4418391/normal_600a586a75432.pdf
- https://cdn-cms.f-static.net/uploads/4486363/normal_603130ef98f4e.pdf
- https://cdn-cms.f-static.net/uploads/4389387/normal_6023cfe38858d.pdf
- https://cdn.sqhk.co/pedajobu/Hidggja/abida_khanam_ki_naat.pdf
- https://cdn.sqhk.co/nobipajami/Ngfejd5/make_your_own_wedding_cake_topper_figurines.pdf
- https://cdn.sqhk.co/mefomixut/jcNGDja/26037825470.pdf
- https://cdn.sqhk.co/badexejos/m9mig8Y/33978268790.pdf
- https://cdn.sqhk.co/numiwufeguv/WA5mijo/lux_light_meter_free.pdf
- https://static.s123-cdn-static.com/uploads/4473064/normal_5fdea43a882a2.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://wimixuv.epizy.com/usmle_step_1_2020_test_dates.pdf
- http://xafofeb.epizy.com/50099871236.pdf
- http://pagitewuzowika.epizy.com/lonefiterijanelef.pdf
- http://poduzamilikuki.rf.gd/50733822078.pdf
- http://semagovolabak.rf.gd/wupixuragekepiwep.pdf
- http://fejusadifidexi.epizy.com/15204279377.pdf
- http://marilineme.epizy.com/free_bootstrap_templates_admin_2018.pdf
- http://kunibenurupamiv.rf.gd/62554199815.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dc57.bin` `ec35a6462b442ef8aea97dbd8ecf47a82ecf5613d29bf8bda6d47665b7841be7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDC57	5488 bytes
`font_01_sfnt_off0000eeaf.bin` `5020e652c0e050d993a294e150cb177f5ca05b68a5f4124c18f7826f7f236311`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEEAF	11496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.