PDF malware analysis — malicious · b3c25aaa400d0823

MALICIOUS

PDF

84.0 KB Created: 2021-04-05 18:41:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: aa6aa8554d2e8b7923fa3c0f630d9444 SHA-1: 7fd140c39c6370dc64ce4fa39ac5793c13bb4301 SHA-256: b3c25aaa400d0823c95188eb7c51209e392c6d498015e3fa607a76b80ce1e1db

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a suspicious domain, likely for phishing or malware distribution. ClamAV and ML classifiers flagged this PDF as malicious, indicating a high probability of malicious intent. The document body, though heavily obfuscated, appears to be a lure related to a movie title, suggesting a social engineering tactic.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crophysi.ru/strik?utm_term=the+death+cure+movie+brenda
- https://cdn.sqhk.co/dofubetu/BCO1jhg/buxivisujuxunusepe.pdf
- https://cdn-cms.f-static.net/uploads/4370071/normal_605659ce82e96.pdf
- https://cdn.sqhk.co/buwaxaxodi/iO7Bpu0/zemepopuwulukedimazet.pdf
- https://cdn-cms.f-static.net/uploads/4388428/normal_5fe722f7d1813.pdf
- https://cdn-cms.f-static.net/uploads/4379054/normal_603344c0d3e92.pdf
- https://cdn.sqhk.co/dabozijide/jGjibge/larufonezub.pdf
- https://cdn-cms.f-static.net/uploads/4446789/normal_601f18f9077d6.pdf
- https://cdn-cms.f-static.net/uploads/4451363/normal_6030e32c0e14b.pdf
- https://cdn.sqhk.co/vetejevibas/0vgd0jj/jubisi.pdf
- https://cdn-cms.f-static.net/uploads/4419623/normal_602c31b013434.pdf
- https://cdn.sqhk.co/gebitasixa/gh764I5/sobajagudumunujonuwaruwak.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/lixisariwulo/gizofasisujuxipidebewi.pdf
- https://s3.amazonaws.com/liwafo/percy_jackson_sea_of_monsters_cast_and_crew.pdf
- https://s3.amazonaws.com/sinadi/pokemon_planet_ev_training_guide.pdf
- http://nefizobutimuzi.rf.gd/45785261814.pdf
- https://s3.amazonaws.com/mujesogi/20671522974.pdf
- https://s3.amazonaws.com/boxalewijim/88458322754.pdf
- http://tavewafed.epizy.com/notuwugazaxibujivufibi.pdf
- https://s3.amazonaws.com/voxipanovigepiv/laserfiche_administration_guide_10._3.pdf
- https://s3.amazonaws.com/suzujewa/vcds_17._8_italiano.pdf
- https://s3.amazonaws.com/wurivuve/79829445383.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001089f.bin` `4666ac7a11dec942073d288eab9af9ebb07d7cac24850a18fd57dfffd3de13ea`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1089F	5120 bytes
`font_01_sfnt_off000119e3.bin` `3a82f16ae7efacb3670361bf2b8a86837111a156a7279e59f52ca9e3d8527072`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x119E3	12416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.