PDF malware analysis — malicious · a1adee59176c0864

MALICIOUS

PDF

93.2 KB Created: 2021-01-16 22:15:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11

MD5: 649dd42dbf5900676c8234f810b1cb8c SHA-1: bc73dcbe838511e6a4648121fd519b9e811d4f1a SHA-256: a1adee59176c0864bc740ade780c46a7b7b5c236364111473966c96c61183dd0

104 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a lure to download a game, indicated by the document body and the presence of external URIs pointing to download sites. The ClamAV detection and ML classifier strongly suggest malicious intent, likely phishing or malware distribution. No scripts were extracted, but the embedded URLs are the primary indicators of compromise.

Machine Learning

Nyx PDF Classifier malicious score 0.9966

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafftec.ru/123?utm_term=download+gta+vice+city+apk+for+laptop PDF link annotation
- https://radopubida.weebly.com/uploads/1/3/4/6/134608457/7729005.pdfIn PDF document text
- https://cdn.sqhk.co/zuxosutuku/iaggSjb/15395748529.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4490523/normal_5fc741970b5a6.pdfIn PDF document text
- https://tesiligozi.weebly.com/uploads/1/3/1/4/131407846/rajapoj-morax-wimuwame.pdfIn PDF document text
- https://dejoputaxili.weebly.com/uploads/1/3/4/7/134763817/8580878.pdfIn PDF document text
- https://setekonireza.weebly.com/uploads/1/3/4/1/134131298/9485598.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/zodawanuror/85082961066.pdfIn PDF document text
- https://s3.amazonaws.com/vazisi/attarintiki_daredi_telugu_movie_ringtones_free.pdfIn PDF document text
- https://s3.amazonaws.com/dusubonifu/call_rest_api_using_resttemplate.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00013235.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13235	5464 bytes
SHA-256: `3ed895c91445e8345b241c82270c13e40222a5f1f00038d93e1521928f26883c`
`font_01_sfnt_off0001450b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1450B	10380 bytes
SHA-256: `0416258893e33ffb7bbd2a7589391718248f1ca827c51695910313d26c8a8440`

Open this report in the interactive analyzer, or submit your own file for analysis.