PDF malware analysis — malicious · fc3dae72f6231551

MALICIOUS

PDF

82.8 KB Created: 2021-05-22 17:04:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23

MD5: f96d349450c92785c76cb4d8ad6c11c5 SHA-1: d6b9ab7b0a785de7e5953d0e224191acafa131ac SHA-256: fc3dae72f623155148e8f7ea6adc57baaa01e769f08a1fc558345a6409b8b962

104 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file presents a deceptive download button. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mezovuduw.ru/strik?utm_term=cubase+le+ai+elements+9+activation+code+crack PDF link annotation
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/3b6b5a53-7eb3-4280-b003-6324912d7c89/lonovugixiz.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ab861c77-e16e-4129-8b69-a78ba85b6520/modern_calligraphy_book_whsmith.pdfIn PDF document text
- https://s3.amazonaws.com/sezebepit/chiru_movie_songs_free_naa_songs.pdfIn PDF document text
- https://s3.amazonaws.com/luropi/methyl_chloroformate_msds.pdfIn PDF document text
- https://s3.amazonaws.com/vofadoloves/libro_el_poder_de_orar_de_madrugada_mercado_libre.pdfIn PDF document text
- https://s3.amazonaws.com/nigimul/schengen_visa_france_application_form_vfs.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e4eef344-bbd6-4bd9-b488-13eeff2f2715/botiquin_de_primeros_auxilios_para_recien_nacidos.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d135025b-937a-417c-bc9c-5f9604fc57fd/62765617157.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0bfbf013-896f-4c6e-a527-1899e7c816b3/lozipat.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6c03d82f-abc9-42ea-bc24-c6fa52ce9be6/98966645289.pdfIn PDF document text
- https://s3.amazonaws.com/vokeri/gitevo.pdfIn PDF document text
- https://s3.amazonaws.com/fokapikow/excel_weekly_planner_template_2019.pdfIn PDF document text
- https://s3.amazonaws.com/futamo/reading_comprehension_exercises_with_answers_grade_10.pdfIn PDF document text
- https://s3.amazonaws.com/babuxufarizuxur/36736409016.pdfIn PDF document text
- https://s3.amazonaws.com/kavalukato/gozame.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bbe0e63e-7b64-4db2-87cc-9e7c95f019f2/gubefilo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8e8dde54-eb95-4a57-8ae8-e5cd8eccbceb/53111275780.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3b36a70e-af2e-466b-b1a8-e52a66d730a8/32897051437.pdfIn PDF document text
- https://s3.amazonaws.com/muwomapotumugi/gadifalesetolo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d5ca1e71-7704-4bce-abc7-230d49837367/bufudakavenejekijop.pdfIn PDF document text
- https://s3.amazonaws.com/bepukuba/nanunapu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/44e9f987-dc58-4dba-aa6c-d8496223937e/air_force_ones_white_high_top_womens.pdfIn PDF document text
- https://s3.amazonaws.com/foneniz/counter_strike_1._6_portable_mac.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c97da03b-b293-4ccc-b472-dca24a87c8dd/zobibijanibisofiser.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/de8fd961-d6a8-47d1-985b-5c76f412cb70/2004_honda_civic_maintenance_light_flashing.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f877.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF877	3208 bytes
SHA-256: `8fe9c360a4f43a9199ef9ada077b8329ec88db9ac86a4a27790a02056db044ce`
`font_01_sfnt_off00010413.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10413	5412 bytes
SHA-256: `d6e0eb1674aa798ddb990061c83e9e676a5af139dd383b36cf51366d12bf8e6a`
`font_02_sfnt_off0001165b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1165B	11612 bytes
SHA-256: `bdae6c5d9193aeb94ac8a2b19c3b2dc330e77458883f145ce05a7b1746bc2923`

Open this report in the interactive analyzer, or submit your own file for analysis.