PDF malware analysis — malicious · cf7d6c70c07686be

MALICIOUS

PDF

217.3 KB Created: 2021-04-02 18:09:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-24

MD5: 256a542920f7ec702c1dee5d45ba8a3f SHA-1: 5a5ff2e6f8d92a39f0d9ebe7ace83020e887bc3f SHA-256: cf7d6c70c07686be107c49b0ec4d2a16a7a4dcd1e21decdd189e19ed974d51aa

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9653

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/wix?keyword=persona+3+hermit+boss PDF link annotation
- https://fekebejoluxoji.weebly.com/uploads/1/3/4/3/134309121/b2df3900e.pdfIn PDF document text
- https://fakimodixoto.weebly.com/uploads/1/3/0/7/130739088/06309a5.pdfIn PDF document text
- https://fubupudixad.weebly.com/uploads/1/3/4/7/134742266/tafoxegutigam.pdfIn PDF document text
- https://bitekiparoduj.weebly.com/uploads/1/3/4/0/134017536/8e24ba8452f.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/f9983342-acea-4102-8f43-d03afab3ac4d/nituginowurupejax.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c29d4ea8-b8de-4731-92be-d2eec8927af6/does_verizon_have_any_flip_phones.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/972dd97e-e87f-4472-9224-fe997a83ca61/dungeons_and_dragons_premade_characters_5e.pdfIn PDF document text
- https://3794eb9c-cc8b-492c-aecc-44533f76aaa6.filesusr.com/ugd/1ee69b_f4b1a395eaf04476950508b0bf805e37.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/31e52ad6-916a-428a-9e89-54ea12a54907/how_to_add_fractions_with_mixed_numbers_and_different_denominators.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/15c43692-5cb6-43ed-bddd-e0081e664736/jedewajovomireb.pdfIn PDF document text
- https://s3.amazonaws.com/lixisariwulo/confluence_page_properties_report_count.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/804cff3c-31b3-4ddd-9ffa-4cbfd9623efe/93754432358.pdfIn PDF document text
- https://s3.amazonaws.com/zemunomipazikez/pure_android_phones_2019_india.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/44248482-6641-4e4b-92be-8e98de1b49de/z_score_table_95_confidence_interval.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3599594e-b9aa-4547-863b-6854f6d5c10f/m-audio_keystation_88es_weight.pdfIn PDF document text
- https://s3.amazonaws.com/boduxatavepe/what_is_the_best_zero_turn_mower_for_the_price.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/679724e9-1f7f-4ad0-b122-6c98441fc3dc/perutifefoj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4226d3a1-5529-4df1-a833-3403c6739446/hp_4630_printer_wireless_setup.pdfIn PDF document text
- https://e26dc784-fa46-4601-9f6d-57686faaf216.filesusr.com/ugd/c66525_6d669fe802474bdda38087b86eb75375.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/1532f4be-ec41-4ed6-9eef-d0844167db73/bela_bartok_mikrokosmos_complete.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/04d21640-bcb2-46f5-86e0-364d27235259/wasuzutibuxi.pdfIn PDF document text
- https://s3.amazonaws.com/sajatofubote/gasomobopipexati.pdfIn PDF document text
- https://bf130ee1-1463-4c69-9604-1b23772ced92.filesusr.com/ugd/b4609a_d4598398b75a4a028244b0b015104f87.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/29b666f3-d10d-4f10-ba56-db5c38e41590/4348786521.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00023e7a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x23E7A	70032 bytes
SHA-256: `5d37fbbeee42bb9e5f68c8819ec46cabca4cc2a15f148395b0d2c849d253acd7`
`font_01_sfnt_off00031055.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x31055	4984 bytes
SHA-256: `d2a9bc8f1190162ca6fe1002a0d247aa1143e35e2690193299b95a7e37a6d134`
`font_02_sfnt_off00032107.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x32107	11860 bytes
SHA-256: `bf2ae1f08628bc4bb9414b9f3b92cd85b3d9263124189f80e22510c8c74f36dd`
`font_03_sfnt_off00034836.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x34836	4324 bytes
SHA-256: `1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e`

Open this report in the interactive analyzer, or submit your own file for analysis.