PDF malware analysis — malicious · 04c58683c338e320

MALICIOUS

PDF

76.6 KB Created: 2021-04-02 11:32:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9d1668b1d89903ca7efb3838cc3ad12d SHA-1: 258938b40104a62724a8d65c786732e74468be73 SHA-256: 04c58683c338e320ad34b7ec69352db7296dbf00645ba81b6164fb2fa342de70

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URL that redirects to a suspicious domain, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URI heuristic point towards a phishing lure designed to redirect users to malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/strik?utm_term=oraciones+con+pronombres+relativos+en+ingles
- http://womuvizitina.mywebcommunity.org/80278854780.pdf
- http://fanisore.sportsontheweb.net/fusionner_plusieurs_fichier_en_un_seul.pdf
- http://finomimetafix.sportsontheweb.net/how_to_oil_a_montgomery_ward_sewing_machine.pdf
- http://bunnygummy.ru/50196771484lwitp.pdf
- http://sportplays.ru/14864060054ndri1.pdf
- http://zubosoxi.22web.org/web_link_to_converter_online.pdf
- http://topcreditcheck.info/32313712083ztohu.pdf
- http://gefosezidubajoz.scienceontheweb.net/ravow.pdf
- http://it50life.pro/535285110566t9gz.pdf
- http://bolipoloweda.mygamesonline.org/allamanda_cathartica_medicinal_uses.pdf
- http://samafutanub.mypressonline.com/craftsman_10hp_30_riding_mower_parts.pdf
- http://tryraisins.club/blood_bowl_skills_swoop0imgr.pdf
- http://rawiduti.medianewsonline.com/lunazezapenuzewuwifiwe.pdf
- http://pixidilivutep.medianewsonline.com/15752018876.pdf
- http://stavki.link/32133942192neqmv.pdf
- http://jedomagisuw.getenjoyment.net/nozixagifoxivowakamovoku.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://wokesoz.epizy.com/phd_thesis_presentation_ppt_template.pdf
- http://rorazizaxaf.atwebpages.com/bobcat_709_backhoe_specs.pdf
- http://duxepivol.myartsonline.com/nemafukabipixom.pdf
- http://godutugogusapa.rf.gd/lexus_gx_460_specs.pdf
- http://fofeparulofiz.rf.gd/binance_launchpad_guide.pdf
- http://jujonejetas.epizy.com/27856212777.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e916.bin` `95f88e0911c60312beb0edf482f1c13de36da58ea196519180942b901508bee3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE916	5480 bytes
`font_01_sfnt_off0000fba7.bin` `2875b73d2fbc46460311d69e3793f9b7626f4b1f5370d9282f34a509edccb965`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFBA7	12340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.