PDF malware analysis — malicious · cff8ea2de11be4a4

MALICIOUS

PDF

68.3 KB Created: 2021-03-14 18:21:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2b5c8ffe9b8871ba75ae38d33740ccb6 SHA-1: 516d01730fcf71e706a4f38cedafc25ae5d1a0e1 SHA-256: cff8ea2de11be4a438ef6183f33173542d63b01f1d85b091f46e9633dc6f2163

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified as a phishing lure. The ML classifier and ClamAV detection strongly indicate malicious intent. The presence of an external URI suggests the document is designed to redirect the user to a malicious site, likely for further exploitation or credential harvesting.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/strik?utm_term=black+max+21+160cc+self-propelled+mower+manual
- http://retamos.mygamesonline.org/harry_potter_wooden_wands_amazon.pdf
- http://ravevuzovije.mywebcommunity.org/hotels_near_cannery_row_inn_monterey_ca.pdf
- http://moxilekulina.getenjoyment.net/debuliwutunebigaf.pdf
- https://cdn-cms.f-static.net/uploads/4462038/normal_6035abd72ae27.pdf
- https://static.s123-cdn-static.com/uploads/4464524/normal_5fcb1db8b7793.pdf
- https://cdn-cms.f-static.net/uploads/4503987/normal_6027f05251fb5.pdf
- http://gafabotipunofu.mywebcommunity.org/pafelasekas.pdf
- http://kiritisivasol.mywebcommunity.org/how_to_write_on_a_file_for_free.pdf
- http://migasoloraluxuj.scienceontheweb.net/tumutiwetufofuvasogido.pdf
- http://gadetebes.sportsontheweb.net/gowexiwatalage.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://dd7ee03d-3646-4e01-a1e1-4c0a7e2c9e57.filesusr.com/ugd/d7ba0f_2fbc219689de4996842a89529e7e49c5.pdf?index=true
- https://3d7304b5-8527-495f-b913-615d6f357a43.filesusr.com/ugd/ef7486_9828d052ee654ffbbbcb8349b45b490e.pdf?index=true
- https://s3.amazonaws.com/fajetufekejo/whirlpool_repairs_near_me.pdf
- http://sakogabutal.onlinewebshop.net/70280750657.pdf
- https://s3.amazonaws.com/nuvukivaxiren/best_free_international_calling_app_for_android.pdf
- https://s3.amazonaws.com/domegagowevag/atmospheric_circulation_worksheet_answers.pdf
- https://s3.amazonaws.com/kalanejaxutilif/49691402385.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cb46.bin` `6e023be4ca98b85e9415ab8e3f6dc761f435fa8e14bd961ca7e784401989475d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCB46	6084 bytes
`font_01_sfnt_off0000e00a.bin` `08ec9a20e0a3a9417884f4e62797322885ac2975a593e02e3b2e856d285f83e2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE00A	10540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.