PDF malware analysis — malicious · 044a93e26d8e4931

MALICIOUS

PDF

71.1 KB Created: 2021-03-15 08:54:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2a241cc9d3ed87ff0527d8568e256f1b SHA-1: d28ad998e65b3fc2f795aafb02057178ad25cc56 SHA-256: 044a93e26d8e4931f93cab83ee48f618920dc69c208d60e337f61a02282ba22b

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URI points to a suspicious domain, likely intended to host a phishing or malware delivery page. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to trick the user into navigating to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://leonvi.ru/wix?keyword=dewalt+magnetic+drive+guide+1%252F4-inch+%2528dw2054%2529
- https://cdn.sqhk.co/powirafawume/CVggAjh/25428101502.pdf
- https://cdn.sqhk.co/baruduwege/jOfGyjd/ralidododoguvu.pdf
- http://rodojad.iblogger.org/foxebanagawoxedobis.pdf
- http://mapotilij.mygamesonline.org/percy_jackson_greek_gods_ar_answers.pdf
- https://cdn.sqhk.co/redixebu/dhcghge/64799996216.pdf
- https://cdn.sqhk.co/jevunazuru/hbicdif/ladasijunufatipipubaja.pdf
- https://cdn.sqhk.co/girasufu/luYiHLT/best_hd_casino_games_for_android.pdf
- https://cdn.sqhk.co/suzironanes/hGgjbvN/gojirefisinuti.pdf
- https://cdn.sqhk.co/xexerekija/63Zlvie/dungeon_defenders_2_characters.pdf
- https://cdn.sqhk.co/bikegola/7ijtTw2/cossacks_3_mac_2019.pdf
- https://cdn.sqhk.co/zetobazox/zgcDtii/rope_bottle_carrier.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/kosipefojaw/44997972469.pdf
- http://zamituzok.rf.gd/vemoviwamekefotazob.pdf
- http://kefuvazaleneze.rf.gd/app_store_badge_deutsch.pdf
- https://s3.amazonaws.com/fajeloninesitel/jagoxizitixavuke.pdf
- https://s3.amazonaws.com/dekogamik/baseball_sask_playoff_manual.pdf
- http://pezefaxovojole.atwebpages.com/45058443666.pdf
- https://uploads.strikinglycdn.com/files/a17aa378-e4b2-45e3-aa1f-45059c80fc88/62486507437.pdf
- https://uploads.strikinglycdn.com/files/cb8eb09e-d236-4a75-90c4-c5adc1b2e7d3/kejenulawupeletaxob.pdf
- http://fiforeru.atwebpages.com/44333682504.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d2c5.bin` `52af4e47fbe51b1100264cb5208853a0adb641a68d025dec6213bcc157c1f85f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD2C5	6084 bytes
`font_01_sfnt_off0000e79a.bin` `358e5d3e8706a2f0b7166b5c4e21600cad0ccb5ed4b2fdf3f1301a8806a5863c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE79A	11532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.