PDF malware analysis — malicious · da648b10603a4481

MALICIOUS

PDF

85.7 KB Created: 2021-06-11 10:22:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25

MD5: 3acb42be8443630783ab976a9709d492 SHA-1: 16af64642867037816173f9abf8a1faf33dfaf06 SHA-256: da648b10603a4481e12a15a2673aa089e163c426cc29ca2acf3e28e9beade77d

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crysiq.ru/pbw?utm_term=hypixel+skyblock+hub+world+download PDF link annotation
- https://cdn-cms.f-static.net/uploads/4474989/normal_602457e2a21f6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4401711/normal_605efc92e15e1.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4452171/normal_600553ca53a5a.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4386829/normal_60478a99888c2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4419205/normal_6028bd04a2292.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4488569/normal_5fcaab846dd0c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4468531/normal_606c90bb3af00.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4389376/normal_606d1a0468bfd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4482407/normal_600f2e851ca6f.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4497359/normal_5fdb81f57a2e6.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/199c98f7-85b3-4824-8a42-78b294dca162/78119365942.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cdc74902-b9bc-4a9d-85dd-286c10c14874/an_essay_concerning_human_understanding_volume_1.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a11f7055-474d-49b5-9df4-ed89a0901546/wifabejiwesoba.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f302e95c-1d8e-477b-b7e4-2c7cf47b1812/belinedu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cd916b91-a2f7-455c-b1f4-18e54c5ac0a6/how_to_identify_black_walnut_in_winter.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4010091f-926d-4568-a272-7b3f39b4f502/42119104872.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6f51113a-59d1-457b-b401-098a9be27216/nutunolaragapemidutevit.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/1807e77f-743f-4cac-b43e-af414061cd2f/how_to_operate_a_electric_pressure_cooker.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9e13aeb7-d7ad-469d-8720-8ef93d2bd5e9/18_week_half_ironman_training_plan.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/07094a0f-8cd8-4974-849d-8f7598855e6e/63466856578.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/aae870f6-a4b9-47a7-ac29-04a6225881c3/dabidaxulunevevema.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9ff34639-c3d3-4045-9dd4-fa4036415b37/what_is_the_density_of_pure_water_in_kg_m3.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/46aef007-17a6-4eff-8add-acd53fbe3f38/the_tempest_ariel_character_analysis.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- https://savannah.gnu.org/projects/freefont/In PDF document text
- http://www.gnu.org/licenses/In PDF document text
- http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fdb7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFDB7	6476 bytes
SHA-256: `526c5a2175551476bef9e67e23fc16d118bda5f5d89964818a68e3a853678add`
`font_01_sfnt_off00010dbe.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10DBE	5588 bytes
SHA-256: `1bf5e0e8e44813b0dbc9829df0e0a1fc99bc5243675675631e70a9304766e25d`
`font_02_sfnt_off000120cd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x120CD	12228 bytes
SHA-256: `bbe3a2b9dcbc908d2e8304c3b4b5d895e72110f126e9b1ec6e38beacb47a908a`

Open this report in the interactive analyzer, or submit your own file for analysis.