PDF malware analysis — malicious · e6b32819690c43d3

MALICIOUS

PDF

176.5 KB Created: 2021-03-05 10:26:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18

MD5: cc14628b2597ea2f148d1d9359fae209 SHA-1: 1af9b6e29eace83ef7159404ed03ae8b2c8fe287 SHA-256: e6b32819690c43d3db3e76896ef782cea85a58633125e62d32928c63a18b67f8

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by multiple heuristics, including a critical finding for brand-impersonation credential phishing (Gmail). It contains external URIs pointing to suspicious domains, one of which is used in a phishing lure. The document body, though heavily obfuscated, contains keywords related to software downloads and cracking, aligning with a phishing pretext. The presence of embedded URLs and the ML classifier's high confidence score support the phishing attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9984

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH

Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://venefosek.weebly.com/uploads/1/3/1/8/131871910/4204408.pdf.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/123?utm_term=avid+pro+tools+9+free+download+full+%252B+crack+windows PDF link annotation
- https://venefosek.weebly.com/uploads/1/3/1/8/131871910/4204408.pdfIn PDF document text
- https://gijejutet.weebly.com/uploads/1/3/5/9/135974865/4a732253c4f.pdfIn PDF document text
- https://bativizamazon.weebly.com/uploads/1/3/4/7/134770744/kobamuradomenap.pdfIn PDF document text
- https://vavulawukuret.weebly.com/uploads/1/3/4/6/134690424/bixufewivufobawigek.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4381321/normal_5ff1917aaac4f.pdfIn PDF document text
- http://jujovobima.getenjoyment.net/how_much_weight_can_you_lose_on_a_3_day_smoothie_cleanse.pdfIn PDF document text
- http://vekisonoloze.sportsontheweb.net/how_to_make_my_iwatch_waterproof.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4393035/normal_5fe320d5b6218.pdfIn PDF document text
- https://zujuwedidikaf.weebly.com/uploads/1/3/4/3/134375258/3135146.pdfIn PDF document text
- https://lexezidelaxo.weebly.com/uploads/1/3/4/6/134605078/1032429.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4478703/normal_603fbdc7a03a7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4490534/normal_60102aeb3abfd.pdfIn PDF document text
- http://kiritisivasol.mywebcommunity.org/jefibo.pdfIn PDF document text
- http://ledozikatiresev.scienceontheweb.net/wizard_sewing_machine_belt.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/figugipopar/gobobowekazuxiku.pdfIn PDF document text
- https://s3.amazonaws.com/bagokiko/69474892263.pdfIn PDF document text
- https://s3.amazonaws.com/toniseligiwuzux/admob_ads_in_android.pdfIn PDF document text
- http://vovakupalujum.onlinewebshop.net/how_to_apply_rossi_gel_polish.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/156c3f96-494e-4f07-844e-06d7b94398c7/21303992749.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7e327ca2-9ff4-4c99-95c4-94ac8020e05a/ligiverajikarumuzovudalij.pdfIn PDF document text
- https://s3.amazonaws.com/tarajix/tangled_movie_in_tamilrockers.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d96abfe7-331b-4244-ade7-2a562680c919/tafavo.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00025f88.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x25F88	5512 bytes
SHA-256: `d1744dc6ce6e4a2424d3b58a5ea5c68d5d7e8b3027f66aec7bcf5cb8f606caa3`
`font_01_sfnt_off00027272.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x27272	13388 bytes
SHA-256: `2d7606b02fcd77076a850c6c16e7334a67f4b6ffb0a288fbe3c3f5f822656dfd`
`font_02_sfnt_off00029e45.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x29E45	16072 bytes
SHA-256: `022d27efce85812889ff33f8e847cd1adfb9dec72dea85501dbffcfe415830a8`

Open this report in the interactive analyzer, or submit your own file for analysis.