PDF malware analysis — malicious · db087f979d416058

MALICIOUS

PDF

75.2 KB Created: 2021-03-19 13:38:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 35de5a66d9877e50acedc1f14e683c23 SHA-1: e84682ca19a59cc5a9bef19997d09a5d7f38e42b SHA-256: db087f979d416058bd1e0f84327eebf9e833c7c44b84db609127c8544b78870c

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains an embedded URI that points to a suspicious domain, likely intended to deliver a malicious payload. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document's content, though heavily obfuscated, suggests a lure related to a 'mining guide'.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pelibifir.ru/123?utm_term=mining+lvl+guide+wow
- http://wejaduz.mypressonline.com/tuzexuvujeliju.pdf
- https://cdn.sqhk.co/vibisimak/gdieUhf/mk11_kompanion_guide.pdf
- https://cdn.sqhk.co/pubisifibuj/BQLgjha/8819028636.pdf
- https://numeroluxovuz.weebly.com/uploads/1/3/4/7/134733954/lomizoji-waledupuluwigir-bisak-tutefo.pdf
- http://vivubowi.getenjoyment.net/61604666015.pdf
- https://cdn.sqhk.co/sowodopevew/jgd1ieX/movie_creator_software_for_pc_free_download.pdf
- http://tevojagi.iblogger.org/xunusipekomejomepo.pdf
- https://fonamajubeb.weebly.com/uploads/1/3/4/4/134474676/zefob_valepamagepuwo_dunisekekemaxas_bifad.pdf
- https://cdn.sqhk.co/rapaxino/yhdBNhj/kafamoju.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/f3bafc0e-df42-411b-a991-3f5b0233aee5/starbucks_menu_philippines_frappuccino_best_seller.pdf
- http://wujewepal.epizy.com/16648173005.pdf
- http://tiredosutozol.atwebpages.com/recent_advances_in_microbiology.pdf
- https://uploads.strikinglycdn.com/files/f2e9ec2d-e6be-4bf8-95dc-ad2857a7ed62/how_to_download_music_for_free_on_android_phone.pdf
- http://zewadajimenu.rf.gd/depeche_mode_wrong_free.pdf
- https://s3.amazonaws.com/ribowexulo/jiguseruresexami.pdf
- https://s3.amazonaws.com/kukazowox/mofabedasigorevufu.pdf
- https://s3.amazonaws.com/ladojenefe/corrugated_galvanized_iron_sheet_specification.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e9f9.bin` `78a3c32de00420bc2fbd19b4168dda1d4b37ff5aed2409349e21ecb9bf51eba4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE9F9	4664 bytes
`font_01_sfnt_off0000fa0a.bin` `06c297ab2610f946fb8cbdd383bfa5497d5235d556a4e39164d243eb8ec8f285`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFA0A	10700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.