PDF malware analysis — malicious · bef168965c60e8e5

MALICIOUS

PDF

89.2 KB Created: 2021-06-09 14:03:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25

MD5: 69eef7827c6611f6811a9ee6bfc82e5b SHA-1: eaff60b5a462d94617c597445b0e2689d1a03506 SHA-256: bef168965c60e8e5dd8cf72a91d38d2579c1e9ad87bcf2923b63a60483f6379d

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9994

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ketchas.ru/pbw?utm_term=sonu+ki+sweety+ki+tweety+watch+online PDF link annotation
- https://cdn-cms.f-static.net/uploads/4368770/normal_6056d4d74fbed.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4388424/normal_5fc78b8f67c4e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4368250/normal_603eedf49691d.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4443371/normal_6035f0ba78fb1.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366949/normal_60bd064b0b7a7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4461234/normal_5fc9997c36894.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366961/normal_6016d5708fa07.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4385434/normal_604a416f8ab14.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4389585/normal_603d241b9131a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4407782/normal_600fe0e95e5d0.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/cf4d5b70-024e-43e9-9fd7-bedbf7cbb96c/the_entertainer_sheet_music_beginner.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5077ba97-d826-4854-b834-3a8e9d7cb7d2/ford_windstar_2003_transmission.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f4ca0fda-76a6-477b-9049-665757f15e3a/do_it_yourself_brick_rocket_stove.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a943a17f-8537-46e9-b971-c6dceba8e1db/60880961816.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/71f24402-928d-4210-a743-3474f5c1d91c/send_in_the_clowns_piano_solo_sheet_music_free.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5fe731f5-beb4-4c96-965a-61b578ba4be5/64824605750.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/de12da64-9ecd-4406-a452-34e9b7e2ae89/mia__sebastians_theme_piano_chords.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0d45f8b5-7910-4ef7-b635-c81621920cd1/82745773300.pdfIn PDF document text
- http://vawijoj.pbworks.com/w/file/fetch/144819828/valuation_cm1_histoire_les_gaulois.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ed2a17ab-9ddb-4d56-81a0-09340510b2cf/bumodovagevewe.pdfIn PDF document text
- http://nagomax.pbworks.com/w/file/fetch/144705141/nexugotojizuvefoxo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b48c8f15-6e4c-4ca5-b262-027941b9c70a/gokox.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010ae2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10AE2	5152 bytes
SHA-256: `9c5555e4d80ac08bdbfd2213a0f4a509f029831b3c26592d6b96b8d25775d6b3`
`font_01_sfnt_off00011c81.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11C81	10956 bytes
SHA-256: `c0923602903650f836635841135940566066f9bb63d72c46c0c17f40254b8785`
`font_02_sfnt_off00014212.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14212	16164 bytes
SHA-256: `c41fc46809d2260d2d1a821cef6bb00dae560fdbad380da94a93f29d012df54e`

Open this report in the interactive analyzer, or submit your own file for analysis.