PDF malware analysis — malicious · de4e35ef2a1d373a

MALICIOUS

PDF

76.7 KB Created: 2021-03-27 10:53:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 46ee07f6ad0047fab92d55e0e4deeb26 SHA-1: 7f7ed8cc13d9e5129ea4927a979c2ea9b92e085f SHA-256: de4e35ef2a1d373aaf1b714b4c711aeb74a3ed62f3944ccf6e1ea61d1ef0b6fb

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a URL that claims to offer game cheats, a common lure for phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://dafemum.ru/wix?keyword=township+game+cheats
- http://cg-designer.xyz/90603990880g98y8.pdf
- http://zoom-omsk.ru/rawiwitozasa5sl8m.pdf
- http://reweder.site/data_warehousing_jobs_in_singapore2ey7e.pdf
- http://organize.shop/soxuxukitilomumegoxije7rniu.pdf
- http://idealica-columbia.site/bertrand_russell_history_of_western_philosophy6kc1l.pdf
- http://art-practice.org/63632061082g8o7s.pdf
- http://medicalpracticementor.com/binary_file_format_extensionuxcog.pdf
- http://astropsychology.site/36512261201zj916.pdf
- http://show-visitor.xyz/77386006126wvqo2.pdf
- http://abwaab.su/mini_cardboard_cutouts_custom4m8a2.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/temujonuwu/do_mustangs_come_in_manual.pdf
- https://944456f3-75eb-4cd6-bbfd-656b3713ada1.filesusr.com/ugd/2c8d66_8726744c03e84f718cbef00c45629929.pdf?index=true
- https://s3.amazonaws.com/xarojapi/bevizunon.pdf
- https://44bb6ee8-a0fe-4f72-890f-0f0a2fec05cf.filesusr.com/ugd/b65acf_c1a8ca54a32f447c958791a99c3275f5.pdf?index=true
- https://s3.amazonaws.com/minabiwa/minexi.pdf
- https://6ddb26ad-aa8e-4a3e-a925-5cef6fc035e1.filesusr.com/ugd/d3d820_886a0251886a4900bb86c53b4b885bb8.pdf?index=true
- https://c2245d91-bd3f-4016-bed3-1da34bcfd793.filesusr.com/ugd/9a652e_e69df06375e14b40911b79cd5533cd99.pdf?index=true
- https://aa514bbb-a96e-4bc9-8ff3-0ca2edd1104f.filesusr.com/ugd/3fc21f_4d7b64d4ab294bb2bd709f6fe79a824d.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ee09.bin` `176251b27a2b0d340f1fa0ab87223ddae99a198dcd66846d55a9d5eb4c0a09b6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEE09	5260 bytes
`font_01_sfnt_off0000ffe4.bin` `8968aac8fa8f594b49ad6aaa2d79f7513b2553fe159565110af2c78a6edd87a0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFFE4	11048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.