PDF malware analysis — malicious · c9092b0862f97206

MALICIOUS

PDF

75.2 KB Created: 2021-02-17 09:26:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-17

MD5: bb415084185244861a6cd4dd387f3d0d SHA-1: a62e9e96e4b62ad04687eb516a73875de936fbf2 SHA-256: c9092b0862f972063ee5a18d25f0769a4c079f2039bdd332b0f0ee492006f338

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to download an APK file, masquerading as a legitimate application. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for distributing potentially unwanted or malicious software. No scripts were extracted, but the presence of a malicious URL is a primary indicator of compromise.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/wix?keyword=megabox+hd+apk+download PDF link annotation
- https://static.s123-cdn-static.com/uploads/4467036/normal_5fc72460585e9.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4416128/normal_5ff5095475992.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4418764/normal_60093b302ac7f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4484641/normal_602c4ddc0c5e3.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4417648/normal_5fdf445c91055.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417123/normal_6018cceb5f98d.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4413842/normal_5fc56bda56f30.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4492246/normal_5fd5f15dcbbed.pdfIn PDF document text
- http://lnstagramsupportinfo.com/todigobaxuvisjcdt.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://sejekaxupoze.epizy.com/antivirus_for_pc_2019_free.pdfIn PDF document text
- https://s3.amazonaws.com/vavejijitatofu/inner_join_vs_cartesian_product_performance.pdfIn PDF document text
- https://s3.amazonaws.com/vovuzize/assamese_song_2019.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eb0d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB0D	5316 bytes
SHA-256: `5b81f4a7f3f7f0e7bba157e38a939bec5b47def97b6746d9263cef7d848cee30`
`font_01_sfnt_off0000fd41.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD41	10184 bytes
SHA-256: `9ebb39ea0d345b06106394b086c40a51c92a3c82ebdfd15ddebbd78b9a5d4244`

Open this report in the interactive analyzer, or submit your own file for analysis.