PDF malware analysis — malicious · b4ed62bef8e136cd

MALICIOUS

PDF

106.8 KB Created: 2021-03-17 04:18:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 87223a453bd0dcbd8cfca5f1a8fe8185 SHA-1: 9fe5335b40d12b347ac86c4d01ce7aad1608aa9d SHA-256: b4ed62bef8e136cd81ee00eb41d0f8824d3b456240c8d155618cc64040d5feca

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by a machine learning classifier and ClamAV as malicious, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://druttle.ru/wix?keyword=dnevniki+vampira+actors', which is likely part of a phishing or redirection scheme. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of external URLs strongly suggests an attempt to redirect the user to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://druttle.ru/wix?keyword=dnevniki+vampira+actors
- http://tibagisuminove.sportsontheweb.net/rijonuzexoleriz.pdf
- http://gexomafe.mypressonline.com/introduction_to_business_ethics_and_social_responsibility_ppt.pdf
- http://carbackseat.site/lord_of_the_rings_trilogy_extended_cut_blu-ray_6_discfsn2t.pdf
- https://cdn.sqhk.co/vawadawuleja/BPJgjIC/bogokijafunepow.pdf
- http://jijuduli.mywebcommunity.org/canada_citizenship_study_guide.pdf
- http://biotringel.shop/luvaxivelejarekuzoml3hpa.pdf
- https://static.s123-cdn-static.com/uploads/4497093/normal_6003586e61f84.pdf
- http://zugemenelil.medianewsonline.com/povemigawelegozopamawij.pdf
- http://xalapuzim.sportsontheweb.net/kuwimafusunegiv.pdf
- https://cdn.sqhk.co/fulaxanew/giDgcCx/pokemon_yellow_gameboy_color_rom.pdf
- http://gratoram.site/22423811893giroi.pdf
- https://static.s123-cdn-static.com/uploads/4475212/normal_5fe1bba850430.pdf
- http://detonic-italia.website/bun_hairstyle_videolbwux.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/xugigabitulu/veluxorilarelademija.pdf
- https://s3.amazonaws.com/sutawowirosuvuv/78685111922.pdf
- https://s3.amazonaws.com/kumasala/receipt_template_fillable.pdf
- http://vafitinupisojud.onlinewebshop.net/housing_benefit_form.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001640b.bin` `b08e664902f460e206d4f5b7eba8ae18034d95b349a1492bd7d867734fce1c1d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1640B	5172 bytes
`font_01_sfnt_off0001759d.bin` `a426f1a00504fa73350f90f157d1e26babde859103a5f6b45d23921f8db8ac55`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1759D	12384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.