PDF malware analysis — malicious · f46f26aa70401723

MALICIOUS

PDF

180.1 KB Created: 2021-05-28 07:45:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 536633bc036ec00b0a63fd5c3275b004 SHA-1: dcadde53cc0e66491babc35e4e92653a3b61792d SHA-256: f46f26aa704017230d9a78a8c834895336a953a202e169a70c13a655b784093a

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URL pointing to a suspicious domain, likely intended to redirect the user to a phishing or scam page. The document body, though heavily obfuscated, suggests a lure related to product instructions, which is a common tactic in phishing campaigns.

Machine Learning

Nyx PDF Classifier malicious score 0.8906

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ponafet.ru/wb?keyword=braun%20thermoscan%20type%206022%20instructions
- https://duxizesojisuvab.weebly.com/uploads/1/3/5/3/135327590/duwiliku.pdf
- https://cdn-cms.f-static.net/uploads/4426260/normal_602f4fcccb60f.pdf
- https://cdn-cms.f-static.net/uploads/4443594/normal_604e33ba362bf.pdf
- https://nagagixibedixu.weebly.com/uploads/1/3/1/6/131606435/sosukubedakumutu.pdf
- https://kupelaranix.weebly.com/uploads/1/3/4/7/134729830/tapigifowefivefoteni.pdf
- https://wiwotejezewol.weebly.com/uploads/1/3/4/6/134691264/601243.pdf
- https://ronafipilegov.weebly.com/uploads/1/3/2/6/132681204/7968957.pdf
- https://cdn-cms.f-static.net/uploads/4387035/normal_5fd789e863255.pdf
- https://rowusebejaron.weebly.com/uploads/1/3/1/6/131637242/pomafa.pdf
- https://cdn-cms.f-static.net/uploads/4369919/normal_6022cb4206c70.pdf
- http://www.typoland.com/http://www.typoland.com/designers/Lukasz_Dziedzic/Copyright
- http://www.typoland.com/
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.thdl.org/http://www.thdl.org/Tibetan
- https://uploads.strikinglycdn.com/files/1dda66de-e0a6-4947-aca2-3a15848b0a60/can_you_keep_a_secret_netflix_rotten_tomatoes.pdf
- https://uploads.strikinglycdn.com/files/657019e3-e43d-45e7-8ebd-b8c16c6934f9/matthew_restall_seven_myths_of_the_spanish_conquest.pdf
- https://uploads.strikinglycdn.com/files/14eab726-dc7b-42d9-99ed-2dd5f4efcecc/greenworks_1800_psi_pressure_washer_warranty.pdf
- https://uploads.strikinglycdn.com/files/d7193680-ad28-4b2e-954b-e5fe47c81282/whose_birthday_is_july_22.pdf
- https://uploads.strikinglycdn.com/files/cccee3ce-f078-44c6-a085-ed3e5259c86f/21293793221.pdf
- https://uploads.strikinglycdn.com/files/5956ce0f-4b19-497e-b367-51e55e99ac5e/67323390485.pdf
- https://uploads.strikinglycdn.com/files/5d49b0ab-41d5-491e-bd3d-705f73e5f484/how_to_turn_on_minn_kota_ulterra_remote.pdf
- https://uploads.strikinglycdn.com/files/3dd4d892-9bbd-4131-9a9a-1cba5f3fe781/rosazukolenijujufogotaz.pdf
- https://uploads.strikinglycdn.com/files/9628a43c-a590-4a19-98d9-c93e70c76180/purevirejusoridi.pdf
- https://uploads.strikinglycdn.com/files/104565ff-c529-403a-96e6-dbb21bc54f9e/dewim.pdf
- https://uploads.strikinglycdn.com/files/9ad9375a-44e3-4094-bd75-fd0a7e609dff/journey_to_the_center_of_the_earth.pdf
- https://uploads.strikinglycdn.com/files/c4ef4ce5-f2dc-46da-9dc8-45afb314091a/trimble_business_center_2.7_free_download.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.htmlTibetan
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 7

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000220df.bin` `8fa5fc47f1c4d577ade0a12cf104f8d2f5d8331d2d553a120b9eeba46afd7401`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x220DF	6168 bytes
`font_01_sfnt_off00023050.bin` `e3a153e3c663258de4050ab70e28bb1e5697214bd655fbed98097171d8b9d0d0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x23050	2860 bytes
`font_02_sfnt_off00023a88.bin` `0bcd7a5c12e1c37101f0491431fdfc3b3f2a4cceab90960b97b6379296ec6ae6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x23A88	5720 bytes
`font_03_sfnt_off00024de0.bin` `9a6de08e6b92e467009616df01804ebbbb5e23eb222d2288fa11cbf9257a7494`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x24DE0	8980 bytes
`font_04_sfnt_off00025fc5.bin` `2499a0148bd4a7e1579928207c0e07833254bcf2298c0de9f7fd6e2b87fe873f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x25FC5	20788 bytes
`font_05_sfnt_off00029892.bin` `19e239e689b3ac4b7cb59e207dfefe9f6ab6e27f20faf732d7cfe0565a506db9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x29892	16840 bytes
`font_06_sfnt_off0002afea.bin` `ad44e6fe9b4096eb7264c5222ed58836c6dabdcf2196b2d6f378aad8e71a82aa`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2AFEA	6284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.