PDF malware analysis — malicious · d4ffb4f988c889dc

MALICIOUS

PDF

82.5 KB Created: 2021-03-06 21:29:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: dafb4c62663c316a80945dc22ee556ef SHA-1: bd5ea082a1bbedd7c2765030fd5689b8ae48d8f5 SHA-256: d4ffb4f988c889dc601aaa8d971da71c32e36c294f0cce08b4a5472863c05ac0

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was identified as malicious by a ML classifier and ClamAV, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'ffxiv beginner crafting guide 2020', aiming to trick users into clicking the malicious link.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jumiwimov.ru/wix?keyword=ffxiv+beginner+crafting+guide+2020
- http://blancop.xyz/zixojarvbu.pdf
- http://miromawetibikew.mywebcommunity.org/27738604488.pdf
- http://odemebayisitrafik.com/costco_lasko_superfanppfdx.pdf
- http://nitesufi.sportsontheweb.net/fisakaxobexaxixaku.pdf
- http://jedilinosur.mywebcommunity.org/56838797808.pdf
- http://kulanefimolon.mypressonline.com/jizuwiverafomamigepajed.pdf
- http://dektesheff.xyz/test_de_canales_de_aprendizaje_para_nios6ysq8.pdf
- http://xafopawiki.medianewsonline.com/medozubavezufojaji.pdf
- http://fejukoturig.medianewsonline.com/diary_of_an_oxygen_thief_book_3.pdf
- http://nuloriwilorij.scienceontheweb.net/reinforced_concrete_design_textbook.pdf
- http://luxomozuk.mypressonline.com/mental_status_exam_child_template.pdf
- http://zimezobot.getenjoyment.net/xomovuke.pdf
- http://megidexabaror.mywebcommunity.org/muvaxujupi.pdf
- http://digitaltoolsfor.xyz/school_days_direct_uniformjn04v.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/sinadi/21923131734.pdf
- https://s3.amazonaws.com/zidenigad/49863484136.pdf
- https://s3.amazonaws.com/wanasuvedigo/ridafotodawifeb.pdf
- http://japinoxizidunub.myartsonline.com/mepilekelal.pdf
- http://kilarosine.atwebpages.com/sylvia_day_crossfire_series_four_book_collection.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010579.bin` `1bd8c4e380d4d3e9551e2b25c1256547647cdb67ad9f72b734cad4401c85394a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10579	5476 bytes
`font_01_sfnt_off0001183e.bin` `5847da7412440ef90a077df8df72b8fdc8c7610cc963cca51c1fadb6fd1f58ea`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1183E	10788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.