PDF malware analysis — malicious · bdea29c01b067730

MALICIOUS

PDF

197.5 KB Created: 2021-04-24 10:15:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23

MD5: 3630fa3d5e0026a99bf545aefdf6f396 SHA-1: 97f63fd5df770f2e475b389deb7b5e97692a57f1 SHA-256: bdea29c01b067730e72d0a561e989d847f20da6c1aa032c46d1a46688caf4719

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9641

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/strik?utm_term=difference+between+maoism+and+marxism-leninism PDF link annotation
- http://fodadasome.iblogger.org/rstudio_cheat_sheet_markdown.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4501029/normal_6056d07a16b88.pdfIn PDF document text
- http://krokoboko3.xyz/computer_systems_analyst_salary_florida2osoj.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417990/normal_60548cb5edd2d.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4403259/normal_60021bbede0b8.pdfIn PDF document text
- http://mon-compte-cmb.best/konivejiwulisxhd9h.pdfIn PDF document text
- http://texewofe.22web.org/google_sheets_script_logger.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4454973/normal_6023a76ff1c01.pdfIn PDF document text
- http://septiki-rf.website/892928755039hm9e.pdfIn PDF document text
- http://lazerepil.site/kemakbzf3z.pdfIn PDF document text
- http://iglivesupportteam.com/1617144013k2781.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://6440a9f6-5e82-4153-977b-4ffe9374ec4a.filesusr.com/ugd/7182f3_00225a06a12b4eaa9216ad0732855489.pdf?index=trueIn PDF document text
- https://171e2b11-24ea-4535-acac-f971ec821c4b.filesusr.com/ugd/a07927_6d5f790045f240ef9a5bb0eab5ff996d.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/4638dbfc-7112-4827-a533-0b410969f283/stihl_fs_76_carb.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5138634a-ee92-4c01-8706-eaf9ca97a733/82297880979.pdfIn PDF document text
- https://s3.amazonaws.com/fupanabivote/rugonivogupoposed.pdfIn PDF document text
- https://676a7a22-5bec-432e-92e0-9d4a0a27851c.filesusr.com/ugd/a1fb72_99c1ccb4707f4eab9cd3714dc0162456.pdf?index=trueIn PDF document text
- http://jorovupidad.rf.gd/bodadakifil.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cb80f3dc-3409-4da7-827e-fe4b5bc9539c/99645298396.pdfIn PDF document text
- http://wefusav.rf.gd/barbie_doll_house_furniture_sets.pdfIn PDF document text
- https://s3.amazonaws.com/xujitezu/kidosagozopirupijumivugan.pdfIn PDF document text
- https://s3.amazonaws.com/wapabefizosumi/beautifulsoup4_tutorial.pdfIn PDF document text
- http://bikogegumibekur.epizy.com/what_is_rapid_diagnostic_test_for_malaria.pdfIn PDF document text
- https://s3.amazonaws.com/fomudebipefasu/free_template_ppt_biologi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d56a7b27-23b0-42b0-919e-b723e5a260fe/antiderivative_of_cscx_cotx.pdfIn PDF document text
- https://4a39c6c9-989b-4d11-b2d8-cc0becc7f193.filesusr.com/ugd/ef0078_dab75e78786a45a3ba462f244fefc76c.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/76612e4a-4a8d-422e-a5b7-5abf9191d1b1/how_long_does_it_take_to_charge_your_magic_mouse_2.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00027717.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x27717	17680 bytes
SHA-256: `9e0140a403f420e2e8eaa7a03015753e0643ccd73d232129eeb17678a5ddf03a`
`font_01_sfnt_off0002af03.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2AF03	5500 bytes
SHA-256: `e863420d3131de5b505b45d049a5d5e47e82af06e4d6ecde6a7aa99bf90f3005`
`font_02_sfnt_off0002c1c0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2C1C0	17224 bytes
SHA-256: `13cfe9abc2e7cbe45727bfd7739d0ed5bf78603293a819bf71cb3a74c90808a0`
`font_03_sfnt_off0002f293.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2F293	16060 bytes
SHA-256: `503f5200e83b189a546b6c6e1d808633a9135186956fe76ff9bd78de3d91e3c6`

Open this report in the interactive analyzer, or submit your own file for analysis.