PDF malware analysis — malicious · cc8e601cf26afbcf

MALICIOUS

PDF

783.0 KB Created: 2021-03-30 18:09:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21

MD5: fb15ef814061c65d80336bec69afea9c SHA-1: 63c9c0c98f2d0b77ff156edb93d7b681f13dd13d SHA-256: cc8e601cf26afbcf163cd20732f5de148d69ccc077fd4f5d54048124cd305a96

194 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a critical heuristic firing for a malicious redirector link pointing to 'crophysi.ru'. Additionally, a high-severity heuristic indicates a password-protected archive lure, suggesting the PDF is a wrapper for malicious content. The ML classifier also flagged the PDF as malicious. While no scripts were extracted, the presence of a malicious URL and the archive lure strongly indicate a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.5587

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crophysi.ru/award?keyword=alta+fidelidade+pdf+download+gratis In PDF document text
- https://laxumobunutag.weebly.com/uploads/1/3/4/0/134017566/88ff3694c4.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4369632/normal_5fd0426790881.pdfIn PDF document text
- http://stroymarketmetal.ru/ripitigeromovodojixoro63kbk.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420905/normal_60314cfd005cd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4485711/normal_6041f324e5021.pdfIn PDF document text
- https://tulaliferejuza.weebly.com/uploads/1/3/0/7/130775137/kitubudanofiti.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4413112/normal_5feaf93dcf456.pdfIn PDF document text
- https://leduzurukidep.weebly.com/uploads/1/3/4/8/134858842/tomados-medavopew-dekixijami.pdfIn PDF document text
- http://lnstagram-support.live/87932080479hf5fe.pdfIn PDF document text
- http://amin-ukraine.net/refopoo8wop.pdfIn PDF document text
- https://kimewazokedusa.weebly.com/uploads/1/3/1/4/131454536/a07dff3.pdfIn PDF document text
- http://motivawka.online/samples_of_good_scholarship_essays1q26j.pdfIn PDF document text
- http://jafebidit.getenjoyment.net/aircraft_maintenance_manual_boeing_737.pdfIn PDF document text
- https://lexijodipegi.weebly.com/uploads/1/3/4/5/134510521/2bc2e250bf6ab.pdfIn PDF document text
- http://lejidakoxinetog.mywebcommunity.org/13193602811.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://futikuzita.onlinewebshop.net/data_structure_interview_questions.pdfIn PDF document text
- https://s3.amazonaws.com/lowuwofuxali/91458936712.pdfIn PDF document text
- https://s3.amazonaws.com/remufuzu/school_improvement_plan_template_doc.pdfIn PDF document text
- https://s3.amazonaws.com/vixuwogetiv/bluetooth_headphone_android_app.pdfIn PDF document text
- http://jifisuxevizek.myartsonline.com/78377700560.pdfIn PDF document text
- https://s3.amazonaws.com/nitizobuv/lineman_and_cablemans_handbook_1st_edition.pdfIn PDF document text
- https://s3.amazonaws.com/wupuxus/39762038724.pdfIn PDF document text
- https://s3.amazonaws.com/ronenitevodo/cuando_se_puede_viajar_entre_provincias_en_andalucia.pdfIn PDF document text
- https://s3.amazonaws.com/sevoga/tedokukenapamodosaxujo.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000bd153.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBD153	5288 bytes
SHA-256: `38bcb2692575124b8be78bc2f6bf09f06253bd2150b87ebe1c81686bc3dc4296`
`font_01_sfnt_off000be384.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBE384	17084 bytes
SHA-256: `e9301cdc8c59804c19d8a089759e3052eb0dead1026cb14a91a4f99a0854356c`
`font_02_sfnt_off000c1493.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC1493	16204 bytes
SHA-256: `c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449`

Open this report in the interactive analyzer, or submit your own file for analysis.