PDF malware analysis — malicious · 07d2f7ccc3d7094b

MALICIOUS

PDF

82.9 KB Created: 2021-03-30 03:38:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 84233b74ec2d4d83dc6676b4aca57751 SHA-1: d82874e5d2614369fed2f7d7d9f1b4e52c38bcc8 SHA-256: 07d2f7ccc3d7094b13e114d6621ab001aaada45443789ae20c001318e344be56

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded URLs, one of which is presented as a 'mosquito magnet repair manual' to deceive the user. The ML classifier and ClamAV detection strongly indicate maliciousness, likely a phishing or trojan delivery attempt. No scripts were extracted, but the presence of multiple suspicious URLs suggests a download or redirection mechanism.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crophysi.ru/wix?keyword=mosquito+magnet+repair+manual
- http://it50life.pro/32264569601zdwif.pdf
- https://cdn.sqhk.co/fogizotufijo/hh7zheB/28638190254.pdf
- http://virnet77.ru/ccie_enterprise_infrastructure2sg0s.pdf
- https://cdn.sqhk.co/temirikuji/fwkqihr/70337385746.pdf
- https://static.s123-cdn-static.com/uploads/4411683/normal_5fca9d6720c69.pdf
- https://cdn.sqhk.co/wupelopu/aEgxGjc/hack_game_implosion_android.pdf
- https://cdn-cms.f-static.net/uploads/4421630/normal_6050f75630f72.pdf
- https://static.s123-cdn-static.com/uploads/4366014/normal_5fc86eb4388e4.pdf
- http://sdfafq.info/project_management_skills_competency_matrixyf4w7.pdf
- https://cdn.sqhk.co/mowuseparap/icfVnPG/roller_ball_bottles_for_essential_oils.pdf
- http://allroadkamchatka.ru/star_chart_mathnzitr.pdf
- https://cdn.sqhk.co/pevelefotuve/I6RKii4/59878600668.pdf
- http://kosiwixiwumizu.iblogger.org/flask_example_template.pdf
- https://cdn-cms.f-static.net/uploads/4369323/normal_60104b93b7859.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://zuwizusiwobo.rf.gd/velili.pdf
- http://wavudipikudela.epizy.com/casio_ga_100_manual.pdf
- http://bobakazof.epizy.com/sixuzokef.pdf
- http://vaxazawodaw.epizy.com/19761232724.pdf
- http://majoxokusixapav.epizy.com/senujemipefizine.pdf
- http://nisalufurawe.epizy.com/pitinufugofone.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000103a8.bin` `beb6cce871b3445812c8ab871ae383b8ba13c034e97dbeec88088c77f60c1988`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x103A8	5272 bytes
`font_01_sfnt_off00011586.bin` `a228dedcbd70caf9938f64ea2f1fa421c267783879739df6576e636c96ffb47e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11586	12064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.