PDF malware analysis — malicious · dc3ae94b84cd17c6

MALICIOUS

PDF

76.8 KB Created: 2021-03-08 18:49:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: cd3a738852c2ea17ee74a96dec73009d SHA-1: 90b9d209112ce04b9a57a08548d7762227a280ce SHA-256: dc3ae94b84cd17c6b6c941f140960c7e7362d002e5b7501e487ddf185786fcf0

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'https://botokaw.ru/award?keyword=arduino+uno+specs+pdf', which is likely used to deliver a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, contains keywords related to the URI, suggesting a lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/award?keyword=arduino+uno+specs+pdf
- http://repair-foto.ru/lukileluzowo9k6vy.pdf
- http://rivilidopu.medianewsonline.com/xebesabuvepit.pdf
- https://cdn.sqhk.co/zavilisuga/i8tojc2/five_nights_at_freddy_s_game_2020.pdf
- https://cdn.sqhk.co/moturalogupe/ZgiYiaD/46364229371.pdf
- http://naliputa.mywebcommunity.org/famazepigukowifexukuleb.pdf
- https://cdn.sqhk.co/jotoselu/aibxKgh/nogurenug.pdf
- https://cdn.sqhk.co/xawefigi/gfL6zja/dogowuzuwumusi.pdf
- http://widonatozeg.mypressonline.com/82325220914.pdf
- http://meetcabinets.xyz/29869233608qb9lc.pdf
- https://cdn.sqhk.co/merabuvi/jbigCKB/ultimate_car_driving_simulator_apk_mod_premium.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/tidigudetefumof/52281420475.pdf
- https://s3.amazonaws.com/lemerisinivum/63900870709.pdf
- https://s3.amazonaws.com/wazorixekunafob/45734615102.pdf
- https://s3.amazonaws.com/dixaleko/gejofuwakibux.pdf
- https://s3.amazonaws.com/nefagolom/gewin.pdf
- https://s3.amazonaws.com/dumupa/amylose_content_in_rice.pdf
- https://s3.amazonaws.com/belopudevuzuza/foxenudale.pdf
- https://s3.amazonaws.com/jivamubug/answer_key_mpsc_combine_2018.pdf
- https://s3.amazonaws.com/tejuvonixag/cheating_guy_meme_template.pdf
- https://s3.amazonaws.com/wolina/23501486157.pdf
- https://s3.amazonaws.com/zategafozasiru/monun.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f239.bin` `d2d7587062da323757ae482ce947324dee83cce4920e8eb3544121e6125f39cc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF239	4896 bytes
`font_01_sfnt_off000102fb.bin` `d2ad1fcfb061bbd14bcd824c8ecab83ed475fefd3396376eed464465fa6ffdc7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x102FB	10200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.