PDF malware analysis — malicious · dbef9cf9ae564875

MALICIOUS

PDF

76.6 KB Created: 2021-05-06 07:21:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3558ce6f97760c81c8b0c7373d48a2c8 SHA-1: 9e0e68eec21dbc3b00c50af6ab5e1b0ec73a8c07 SHA-256: dbef9cf9ae56487527218fca86f6da6ca1ca1972374f0468d2bd5ea0237836ea

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF containing an embedded URL that redirects to a suspicious domain, identified as malicious by ClamAV and ML classifiers. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create malicious PDFs. The presence of an external URI points towards a phishing or redirection attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/strik?utm_term=star+trek+2009+soundtrack+vinyl
- http://vetozadep.mywebcommunity.org/mafopugusaxipuk.pdf
- https://cdn-cms.f-static.net/uploads/4365560/normal_604f7b882d838.pdf
- https://static.s123-cdn-static.com/uploads/4421049/normal_5ffa2db99ff6b.pdf
- http://sesiruwasos.22web.org/excel_2020_charts_tutorial.pdf
- https://static.s123-cdn-static.com/uploads/4380876/normal_5fcc9fa5e1e08.pdf
- https://cdn-cms.f-static.net/uploads/4447460/normal_60228e6e08c8e.pdf
- http://claire-irk.ru/xewovilipopifete04cyw.pdf
- http://meetsoda.club/butelogorevowifuxalesfxljd.pdf
- http://flowerport.store/zefepu3ynyu.pdf
- http://busibear.com/268067184imivl.pdf
- http://scoretdho.best/dutiteqeqf9.pdf
- https://static.s123-cdn-static.com/uploads/4383579/normal_5ff19aa79f247.pdf
- https://cdn-cms.f-static.net/uploads/4459180/normal_5fe77592a1686.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/wupuxus/supasigisane.pdf
- http://zisigogemewuju.epizy.com/esv_journaling_bible_large_print_leather.pdf
- http://dasobiviwadodaj.atwebpages.com/83765657786.pdf
- http://gajutar.onlinewebshop.net/editable_bingo_template.pdf
- http://zesivukawavomu.rf.gd/hormonas_vegetales_auxinas.pdf
- https://s3.amazonaws.com/furunumaroxun/41942173622.pdf
- http://romulomejalu.rf.gd/what_is_the_self-efficacy_theory_and_how_self-efficacy_can_be_increased.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ea0a.bin` `2afa3fcf68e862057f0fdc9a56b33ea9462b148ec249699c5efc3504ee2d3808`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEA0A	5692 bytes
`font_01_sfnt_off0000fd89.bin` `62e00bba3785a1c602237523373225ec90ef62a55eaf638a318fbbcd95b6b188`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD89	11692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.