PDF malware analysis — malicious · 06ef93521c7c22a4

MALICIOUS

PDF

91.0 KB Created: 2021-05-12 15:00:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-10

MD5: d642203a1fc9ccf2fd685418251bfdcc SHA-1: fa8da3adaa34a51615ce13b49ac0683192bea793 SHA-256: 06ef93521c7c22a4f326d7eb0d1c36d08a231f15ebc4f0a5888000495eae2c19

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by a ClamAV detection and an ML classifier. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though partially corrupted, contains keywords related to 'Arduino mega size' and application metadata, suggesting a lure to disguise the malicious intent. No scripts were extracted, but the presence of external URIs and the overall malicious verdict strongly indicate a phishing or malware delivery attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9983

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/strik?utm_term=arduino+mega+size+cm PDF link annotation
- https://posoxunek.weebly.com/uploads/1/3/4/4/134460252/ce69a959a23a6a.pdfIn PDF document text
- https://ganeravis.weebly.com/uploads/1/3/1/3/131384604/c0958.pdfIn PDF document text
- https://tekegalesi.weebly.com/uploads/1/3/0/7/130740489/daluzuxodew.pdfIn PDF document text
- http://plafond.xyz/2007_chevrolet_impala_tire_size_p225_60r16_lsak7al.pdfIn PDF document text
- https://gesogakit.weebly.com/uploads/1/3/4/5/134581759/8373018.pdfIn PDF document text
- http://wrinklestiltskin.com/sat_practice_test_8_section_3_answersrr0t3.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4379851/normal_604330e68bc25.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4496605/normal_605b8166d9928.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4420448/normal_604750701524c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4460233/normal_606026bb41da1.pdfIn PDF document text
- https://sexedevojaboto.weebly.com/uploads/1/3/2/6/132695366/44b283558e18ac7.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413578/normal_5fdbeb7e34f7e.pdfIn PDF document text
- http://remontlegko.info/945110627521i9u2.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/3ab61dfa-d523-46a5-a43d-492d00b69e8c/89350886973.pdfIn PDF document text
- https://s3.amazonaws.com/wifiduxezo/puvusof.pdfIn PDF document text
- https://s3.amazonaws.com/kufazete/27018391046.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6ce9f6b6-7c93-40ef-aa44-ba421da75646/what_are_the_different_levels_of_healthcare.pdfIn PDF document text
- https://s3.amazonaws.com/genedesowul/xojufow.pdfIn PDF document text
- https://s3.amazonaws.com/fezenur/41278847166.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/abbf10fc-17bd-4433-9069-3470f41a7b48/10722366483.pdfIn PDF document text
- https://c370dac7-4848-4fa0-a6df-94361299e8ba.filesusr.com/ugd/fa6303_9f0a6e70f33d4a52a005fd3875b23385.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/tokatefozude/ap_french_vocab_lists.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/451005d4-3ae9-4df2-a093-933213b237b3/wordpress_tutorial_free_themes_for_business.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/c72f4adf-dbfb-4f27-bb5e-7e425926f392/can_you_shoot_a_bow_in_your_backyard_edmonton.pdfIn PDF document text
- https://11ca5eb4-0abe-4d5d-8073-3f36f6088e80.filesusr.com/ugd/8b62d8_19684a1f7c314cf3a93fe1f7ac3bd108.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010450.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10450	2960 bytes
SHA-256: `3c6502e04658d985b37ed967139d4b1bb7136c1c8ff06868e6b64c17630b7d50`
`font_01_sfnt_off00010ed3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10ED3	5268 bytes
SHA-256: `77d462e8ff047a255458197996fa4fa79bff31435b013a05769fa9695d809820`
`font_02_sfnt_off000120ad.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x120AD	11684 bytes
SHA-256: `a106fc0175ae31666bc5c469b0c100ee1039fbba264187bbd2e70c6670c8c933`
`font_03_sfnt_off000148ae.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x148AE	16140 bytes
SHA-256: `159427b32ed66bfbde86def5e6c2992bde67dfb25400c4000a37c9b59b949b61`

Open this report in the interactive analyzer, or submit your own file for analysis.