PDF malware analysis — malicious · dfc1e3227e71ef33

MALICIOUS

PDF

79.7 KB Created: 2021-05-21 03:05:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-21

MD5: 5543ea4f856bfa81e192ed0b03dc5fbd SHA-1: e26c995ade8da69037e74b23bc6abef389dde1bc SHA-256: dfc1e3227e71ef33dcf01f7cdad12887e5e8dd9d6438e71e5987728519fd6883

104 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The file is a PDF document flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier with high confidence. It contains an embedded URL pointing to 'vilenefex.ru', which is likely the distribution point for a malicious payload. The presence of a 'download button' heuristic further supports the phishing and payload delivery intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/strik?utm_term=writing+formulas+and+naming+ionic+compounds+worksheet+answers PDF link annotation
- https://cdn-cms.f-static.net/uploads/4422180/normal_604399bcd24cd.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4493198/normal_601ce17b9f561.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4405644/normal_6033c3d4d3838.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4495257/normal_5ff006263ba49.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://uploads.strikinglycdn.com/files/799f4993-e8bf-41fa-8c8c-b4b209a9ae78/56651325166.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f260b7f2-f242-4b13-8efc-ab59ebe98bb0/is_papa_johns_bad_for_you_reddit.pdfIn PDF document text
- https://s3.amazonaws.com/zafijukopa/memu_android_emulator_offline_installer.pdfIn PDF document text
- https://s3.amazonaws.com/xukirizugukugi/lujagimadaxidotowik.pdfIn PDF document text
- https://s3.amazonaws.com/xebuvuwov/checkbooks_represent_a_form_of.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8b024ac0-9fbb-438a-ac2b-669e20ccecc6/doxobujifojoromagujozinit.pdfIn PDF document text
- https://s3.amazonaws.com/fadedosi/script_type_template_html.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5bd0dc7c-dfe3-4524-9655-8b00a1dc3d52/ejercicios_de_comprension_lectora_para_nios_de_cuarto_grado.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7f2b0576-11cb-48e9-bb79-8be498432b0e/biranuluwegatevobewo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/f022fffa-6d6e-4966-9b4a-952cb4157f8d/kupaduguvasapataduti.pdfIn PDF document text
- https://s3.amazonaws.com/tawovojo/teruwisitokezoxijisemap.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7dbaf0e0-3fa3-4880-a60c-f65d40e67d28/dell_optiplex_gx620_memoria_ram.pdfIn PDF document text
- https://s3.amazonaws.com/tamobalasu/ethyl_chloroformate_reaction_with_water.pdfIn PDF document text
- https://s3.amazonaws.com/rodiligarexo/42773843593.pdfIn PDF document text
- https://s3.amazonaws.com/pezofut/application_letter_format_in_english_for_school.pdfIn PDF document text
- https://s3.amazonaws.com/jinabom/impulse_response_function_fourier_transform.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3e41c724-fb92-4c14-8d2c-81bcdff9d06d/komekawigusu.pdfIn PDF document text
- https://s3.amazonaws.com/tojazudibumogab/wisagenagose.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5df33f78-1eae-4397-9fca-d9cabb606df4/51836504974.pdfIn PDF document text
- https://s3.amazonaws.com/donukadizolin/schopenhauer_the_world_as_will_and_representation.pdfIn PDF document text
- https://editors-cdn.template.net/assets/sls-pricing-page-prod/_next/static/chunks/c8f7fe3b0e41be846In PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eb00.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB00	5620 bytes
SHA-256: `b902d0ef680a7af158f4b47d99173e96304e571a48e14db2ab7179113915283c`
`font_01_sfnt_off0000fe06.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFE06	10812 bytes
SHA-256: `25f9b2153ccbd6308e58fbcc75f87dc487504d3cf7126dd7fccfbad10c4a8053`
`font_02_sfnt_off000122d2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x122D2	4324 bytes
SHA-256: `d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378`

Open this report in the interactive analyzer, or submit your own file for analysis.