PDF malware analysis — malicious · b4db991efecdbc44

MALICIOUS

PDF

75.3 KB Created: 2021-04-01 04:05:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23

MD5: dde74f1c03c1b918e032d3220e52f9ce SHA-1: d4cdec46009023de96d82ed675bdf15bee35aff8 SHA-256: b4db991efecdbc44d609d625666dcafabe304d33de2ba19e5aaf1cdc9ef26874

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9948

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gimoguvi.ru/wix?keyword=gcf+lcm+word+problems+worksheet+pdf PDF link annotation
- http://xuxikurov.mygamesonline.org/autobiography_of_apj_abdul_kalam.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4458417/normal_603bdbf6b96b6.pdfIn PDF document text
- http://towexiwi.sportsontheweb.net/28091719700.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4371025/normal_6013592e59b6b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4466662/normal_605a741229b2c.pdfIn PDF document text
- http://bexixibeguben.sportsontheweb.net/9346340925.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417308/normal_600ff50a9522e.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/2843a4a4-e9c6-407e-8168-903427c4d974/how_to_promote_social_skills_in_the_classroom.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/124cc4c8-4bdb-4407-87a9-567327d50399/how_to_apply_a_vinyl_wall_sticker.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/adb6a47d-c385-447c-bb29-1ec1961ae430/mulagefegared.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b69e19cc-9b85-4ddd-ad1a-60bf9195ed35/optical_fiber_communication_p_chakrabarti_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c907cc75-4b96-4642-8ad1-ca1050d74501/womexixotegul.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/088789e0-ddd8-4749-8ee7-5ae58095fa24/97192787437.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a03c8c38-c735-42e7-bddf-da0fd15ef5fc/ruroxejobuvof.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ad427552-fac4-42b8-a2d1-2de43f0f2dfc/vepigudiwutegabirezelena.pdfIn PDF document text
- http://roxujewov.myartsonline.com/loluposan.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b5c3ad9d-4331-4417-bc6c-51d5e89bd55c/19051973780.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/02bd345b-b1ae-4ae9-9429-0da26cd56af6/what_does_4_channel_cctv_mean.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dbf9b509-dfdb-4d90-84ac-0025b90944d3/zasudigesigivofe.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8cd86c74-f686-476f-8f61-d08a9fae30b3/vowuzepomase.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7b0ef0df-4942-4adf-aea1-1f668b146a50/is_2.1_amp_fast_charging.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2666b4d8-4733-4deb-8932-a237af48d863/53641715780.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/26b1217c-9822-41b0-aab9-d38118ff5231/lonov.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/119974e4-614b-4d40-afb4-84b178b560b9/what_were_the_different_plans_for_reconstruction.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/35e25c36-4eed-4400-8d9f-ced0fd6fb537/35015598014.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b6faa189-be6c-4d6c-8f2c-9b2fc83a1890/12300685270.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ab6daed8-d5da-43f1-8efd-e707b3e4036a/polaris_sportsman_400_2_stroke_carburetor.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dbbe.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDBBE	5148 bytes
SHA-256: `c0da2ac81d32f8fad2263a95a9f18f328abae9e2f069ff4052ecc77ae5a05b7c`
`font_01_sfnt_off0000ed56.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xED56	10444 bytes
SHA-256: `f4a0a5d81f7b9ca36272a1dca76716eb539c60dcfad29b6801927a0e097518f2`
`font_02_sfnt_off0001113f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1113F	4324 bytes
SHA-256: `7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71`

Open this report in the interactive analyzer, or submit your own file for analysis.