PDF malware analysis — malicious · b6326c4cd44cf388

MALICIOUS

PDF

97.5 KB Created: 2021-03-30 11:16:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13

MD5: 8e66987296322ddf073bf4400ae1e853 SHA-1: 3182ea07bd746bd7f06cb51ef9064af5ecb2b51f SHA-256: b6326c4cd44cf388642b01c1c8b392a6229b55f9d476d18383bd145e8115bb9c

136 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded URLs, one of which is flagged as malicious. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware delivery. The presence of 'cmd.pdf' in the document text suggests an attempt to execute commands, possibly via embedded scripts.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/wix?keyword=trapezoids+review+worksheet+answers PDF link annotation
- https://cdn.sqhk.co/pewesopefim/ggheids/gambero_rosso_2020.pdfIn PDF document text
- https://cdn.sqhk.co/kufiremikaf/87geAwR/musica_italiana_bruno_ferrara.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4456119/normal_602aa94d93c94.pdfIn PDF document text
- http://wowezixuxaxu.22web.org/mefajulimufujobi.pdfIn PDF document text
- http://belplitka.ru/zozefekinudo0mvvc.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4426425/normal_5fcaf21de1527.pdfIn PDF document text
- http://axecheat9.xyz/tojikatedenkfc5p.pdfIn PDF document text
- http://gutemirofexobu.iblogger.org/how_to_change_computer_ip_using_cmd.pdfIn PDF document text
- https://cdn.sqhk.co/miwurazaz/jcichit/kidirejolop.pdfIn macro / runtime command snippet
- https://cdn-cms.f-static.net/uploads/4459337/normal_604a668f1d75f.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4384655/normal_6004bfa71880a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/lijulijowivaze/speed_and_upload_speed_difference.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2f5d8b75-421e-4fdf-8bc7-83ff8663fecd/munumarufigomupu.pdfIn PDF document text
- https://s3.amazonaws.com/vavabi/garegide.pdfIn PDF document text
- http://womumilo.epizy.com/ruzejonapof.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1228b68c-9921-4c7e-a18b-cd5c98d3ebe5/49717684290.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2c918b90-d85c-48eb-8f55-76fe0b7dad32/numakapuno.pdfIn macro / runtime command snippet
- https://s3.amazonaws.com/latufenaw/super_fund_performance_comparison.pdfIn PDF document text
- https://s3.amazonaws.com/tizowodifi/kemekazozilejudadumipoki.pdfIn PDF document text
- http://fuguduvuduwir.epizy.com/marathi_calendar_2020_download_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/34fc5b26-e181-437d-8e32-c75a1b566a31/28012344008.pdfIn PDF document text
- https://s3.amazonaws.com/jalasilunaz/reading_tips_for_students_with_dyslexia.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000114f7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x114F7	6736 bytes
SHA-256: `97310e43fcee3077eeb4eee4a5622439c92256900cbf74b1bf48150531466804`
`font_01_sfnt_off000125d4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x125D4	5232 bytes
SHA-256: `34843bc424b7c92f926f3cf93bc97b544ba469dcde54ee39b5c7704b9c270fad`
`font_02_sfnt_off000137b6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x137B6	12548 bytes
SHA-256: `182ae87e1f4e3b896a8fc6336a3287be7d0446c4025c591d5b923347dc6abd14`
`font_03_sfnt_off00016249.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x16249	16280 bytes
SHA-256: `0eeb71651a0796906f683bfddb3e08942258f9bbee6b2faae2101c838736fae7`

Open this report in the interactive analyzer, or submit your own file for analysis.