PDF malware analysis — malicious · e94ac9d4d655f7f3

MALICIOUS

PDF

264.3 KB Created: 2021-06-04 18:51:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-22

MD5: f30751fb65cf909d9b2d7629948cef3a SHA-1: d983adcf2acbc33e605255c6e090215859de52f9 SHA-256: e94ac9d4d655f7f31e1709cefa9e1af11113e861994598aa6c645633ee09e40a

256 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a fake browser/software-install lure, a callback-phone (TOAD) lure, a clipboard-command (paste-and-run) lure and a seed-phrase/secret-recovery lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9766

Heuristics 8

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE

Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE

Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://bologen.ru/123?utm_term=mozilla+firefox+esr+60.+8.+0 PDF link annotation
- https://cdn-cms.f-static.net/uploads/4409396/normal_6030a1c3da02b.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4403824/normal_60020077da1de.pdfIn PDF document text
- https://bidiguregila.weebly.com/uploads/1/3/4/7/134700143/mazusilotelanetoj.pdfIn PDF document text
- https://kuwovewifinux.weebly.com/uploads/1/3/0/7/130775990/5515485.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4389793/normal_5fddb810872a2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4502819/normal_60524a698442d.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4486060/normal_60071a97a415f.pdfIn PDF document text
- https://buzotifosu.weebly.com/uploads/1/3/2/6/132695554/e876be29a1091.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4423442/normal_606de0fd072b9.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4453889/normal_5fc5b1fd66e12.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366376/normal_604620cb393e5.pdfIn PDF document text
- https://wosumugip.weebly.com/uploads/1/3/4/8/134867897/3c76cb.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4443357/normal_5ffdae595ae3f.pdfIn PDF document text
- https://lazoseroli.weebly.com/uploads/1/3/5/3/135316949/07f58d304802.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4485578/normal_5fe4750ebf2e5.pdfIn PDF document text
- https://gobalubige.weebly.com/uploads/1/3/5/3/135339343/d0d81.pdfIn PDF document text
- https://pesilukijirizi.weebly.com/uploads/1/3/4/8/134864792/d4113.pdfIn PDF document text
- https://dokarugosili.weebly.com/uploads/1/3/4/3/134362608/8833207.pdfIn PDF document text
- https://rulodewarozuw.weebly.com/uploads/1/3/4/6/134678260/tedibu.pdfIn PDF document text
- https://nunigagajil.weebly.com/uploads/1/3/4/7/134751499/durik.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4411219/normal_604ad81d31e13.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- http://vaporezikumu.pbworks.com/w/file/fetch/144614733/51442289210.pdfIn PDF document text
- http://tiduxikuve.pbworks.com/w/file/fetch/144421671/shadow_fight_2_special_edition_hack_mod_apk_android_1.pdfIn PDF document text
- http://sawanixum.pbworks.com/f/214799082.pdfIn PDF document text
- http://fuxedemama.pbworks.com/f/how_to_retune_my_panasonic_viera_tv_to_wifi.pdfIn PDF document text
- http://vatojorisa.pbworks.com/f/pile_reinforcement_design_example.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0003c134.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3C134	5008 bytes
SHA-256: `63d4d463a88340120aa4f3acfd058cadc84300318b1fc812025e402380d0d33e`
`font_01_sfnt_off0003d252.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3D252	12356 bytes
SHA-256: `3562b08980580964b13548558116454d3a94d35ac052b901826bb1711cec08c1`
`font_02_sfnt_off0003fc7a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3FC7A	4324 bytes
SHA-256: `9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2`
`font_03_sfnt_off00040a2d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x40A2D	1736 bytes
SHA-256: `5095ccdfdd328c3f25b1766e9c65bca58fa839170fcb9f3db3c20e130d955aff`

Open this report in the interactive analyzer, or submit your own file for analysis.