PDF malware analysis — malicious · dc3856f049eb0342

MALICIOUS

PDF

97.0 KB Created: 2021-03-09 23:29:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20

MD5: 4e97ad17982fcf8312ff2b4bc098b3b1 SHA-1: cfc1b41270522dba4134951c785df441e86ac7b3 SHA-256: dc3856f049eb0342fbfe2ef99c09dfebebc30d0a15cafbca0b226a8dedbfe6f8

194 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample was flagged by multiple heuristics, including ML_NYX_PDF_MALICIOUS and SE_PAYMENT_REDIRECT_LURE, indicating a phishing attempt related to financial information. The embedded URL `https://crophysi.ru/award?keyword=axis+bank+nri+account+form+pdf` strongly suggests a lure to obtain banking details. While no scripts were explicitly extracted, the PDF structure and embedded links are indicative of a malicious document designed to redirect users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9946

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE

Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crophysi.ru/award?keyword=axis+bank+nri+account+form+pdf In PDF document text
- https://cdn.sqhk.co/ruvonusebex/xj8gxhf/ted_bundy_cave_locations.pdfIn PDF document text
- http://triple-doska1.club/zazisemawenelakujawxcvj.pdfIn PDF document text
- https://cdn.sqhk.co/mosepoxik/3Dgeig7/gopi_doll_fashion_salon_2_game_download_apk.pdfIn PDF document text
- http://fibiver.mygamesonline.org/pioneer_sph-da120_installation_manual.pdfIn PDF document text
- http://tapidiv.medianewsonline.com/77065831175.pdfIn PDF document text
- http://vladport.ru/julius_caesar_act_3_scene_1_summary_and_analysismxb68.pdfIn PDF document text
- http://bagomebefekixob.getenjoyment.net/60370644052.pdfIn PDF document text
- http://kawasus.scienceontheweb.net/allison_transmission_rebuild_manual.pdfIn PDF document text
- https://cdn.sqhk.co/totimujid/hchgrs8/dentures_and_demons_walkthrough_chapter_6.pdfIn PDF document text
- http://wuvuzijime.22web.org/whatsapp_business_apk_mod.pdfIn PDF document text
- http://vitrinachel.ru/name_of_p4o109wdfv.pdfIn PDF document text
- http://espaceabonne.com/28208479722eotbo.pdfIn PDF document text
- https://cdn.sqhk.co/dafisuwikib/hdzWYhc/general_grievous_lego.pdfIn PDF document text
- http://shopyou.online/how_to_rap_faster_and_clearpnng8.pdfIn PDF document text
- https://cdn.sqhk.co/nesorosuxim/1hbheah/shark_outfit_runescape_3.pdfIn PDF document text
- http://viwafuxofiseko.getenjoyment.net/basel_ii_pillars.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/mejigavukolu/navien_nr-240a_specs.pdfIn PDF document text
- https://s3.amazonaws.com/senodiw/instagram_logo_svg.pdfIn PDF document text
- http://vetarobafawuk.epizy.com/android_9_pkq1_features.pdfIn PDF document text
- https://s3.amazonaws.com/bitajemisajoz/3172695084.pdfIn PDF document text
- https://s3.amazonaws.com/ritoma/romanian_deadlift_form_cues.pdfIn PDF document text
- http://juwesavel.rf.gd/free_autocad_viewer_for_windows_7.pdfIn PDF document text
- https://s3.amazonaws.com/kotodur/ruxepapuve.pdfIn PDF document text
- https://s3.amazonaws.com/resixexi/zofran_davis_drug_guide.pdfIn PDF document text
- http://sixobujogek.rf.gd/gehaltsvorstellung_absolvent_formulieren.pdfIn PDF document text
- https://s3.amazonaws.com/dikobepibelun/mopipijowupavodopo.pdfIn PDF document text
- https://s3.amazonaws.com/fenatagazise/zikitet.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000130cd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x130CD	5292 bytes
SHA-256: `62e2b1291755d27476d0ca5006adbfdf2e4c15c698069897974bdc2f1529bf9e`
`font_01_sfnt_off0001429b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1429B	10924 bytes
SHA-256: `166b47d0f2e8b7fd2603a8f6f8f2b636b3b5aa238b27f4e67965ff29d5489b5c`
`font_02_sfnt_off000167eb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x167EB	4324 bytes
SHA-256: `a542ec26cea93e049a2e27cd59b1347dd9bbdea13775fd7b822b3c2b3136116f`

Open this report in the interactive analyzer, or submit your own file for analysis.