PDF malware analysis — malicious · 9eb55e97f20365f0

MALICIOUS

PDF

77.1 KB Created: 2021-03-17 03:13:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 83b0d974ec54a0c29e9b2bb2da8f13df SHA-1: 5d8f83e906a8cb6e384aecdbd310ca14ccba1709 SHA-256: 9eb55e97f20365f04d6db5a7c0d8609ff679eadd44c13e6af7a1e6bf404507cd

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URL that directs users to a site offering 'immortals apk and obb download', suggesting a lure for users seeking game files. While no scripts were directly extracted, the PDF structure and embedded URI indicate a phishing attempt to trick users into downloading potentially harmful content.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/wix?keyword=immortals+apk+and+obb+download
- https://static.s123-cdn-static.com/uploads/4384831/normal_5fedd25fd18ec.pdf
- https://cdn.sqhk.co/kipezipilojo/iGFjfii/how_to_make_a_3d_origami_swan_instructions.pdf
- https://cdn.sqhk.co/wazikunal/gHjhjgi/pull_him_out_game_app.pdf
- https://cdn.sqhk.co/vimerokil/O6ogdyu/70234147847.pdf
- https://static.s123-cdn-static.com/uploads/4471513/normal_5fdfc89823aaf.pdf
- https://cdn.sqhk.co/gapekozuwa/hFN2ljg/dynamons_world_2_by_kizi_mod_apk_download.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/f13ec52f-2e53-43e6-942b-acfdc0cb4690/ti_84_plus_ce_games_pokemon_red.pdf
- https://s3.amazonaws.com/daniwodug/pibozosadibosalovev.pdf
- https://s3.amazonaws.com/dukajevo/esl_food_worksheets.pdf
- https://s3.amazonaws.com/sebunuzu/41585373822.pdf
- https://uploads.strikinglycdn.com/files/add04430-dafb-41c6-b203-1ac03d25e41c/washington_football_team_jerseys_2020.pdf
- https://s3.amazonaws.com/dezajok/katokuwugiweka.pdf
- https://s3.amazonaws.com/voropa/jibelevexodevomozodobezaf.pdf
- https://s3.amazonaws.com/fapaga/fepilevunafojobokesabiken.pdf
- https://s3.amazonaws.com/xebuvuwov/books_to_read_in_2019.pdf
- https://s3.amazonaws.com/tokatefozude/bakery_shop_game.pdf
- https://s3.amazonaws.com/kabisebax/savinij.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000efb6.bin` `c521a2271898a689c37be5d945f997e1bb8f1e70fbd947fe556f6bfd2250ee50`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEFB6	5340 bytes
`font_01_sfnt_off000101cb.bin` `e840d89b84e3daaffa68d1ba4b7b69819cfd037a19516aca65c0a740f7d732b3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x101CB	10944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.