PDF malware analysis — malicious · 0f163bae26cbcb4b

MALICIOUS

PDF

123.7 KB Created: 2021-03-15 22:22:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a95afdf5f29d0de1ae87abd5f698ef6d SHA-1: 43db3c1ddf3a14af5fe078551c86979268b9373d SHA-256: 0f163bae26cbcb4b967ceea7d484a9d21d44b55714094cad5f45d7b5b049463c

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was flagged by a machine learning classifier and ClamAV as malicious, with a high risk score. It contains multiple embedded URLs pointing to external resources, suggesting a phishing or malware distribution attempt. The presence of these URLs and the ML/ClamAV detections strongly indicate malicious intent, likely related to phishing or delivering a second-stage payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://golowaki.ru/aws?utm_term=how+to+make+procedural+textures+in+unity
- http://wefilevazobakeb.mypressonline.com/anexarea_crimeei.pdf
- http://momentikshop.space/google_digital_skills_exam_answersry91l.pdf
- http://prizinsta.online/semubagufaj33nb.pdf
- https://cdn.sqhk.co/fusaduxuw/hjemhd9/escape_room_adventure_mystery_parallel_room_game_cheats.pdf
- https://cdn.sqhk.co/susojareb/g2Zgfie/classroom_management_techniques_for_preschoolers.pdf
- https://cdn.sqhk.co/gadujotev/hgjccRM/home_remedies_for_muscle_pain_in_leg.pdf
- http://valamivu.22web.org/elementary_korean_second_edition_download.pdf
- https://cdn.sqhk.co/duwenaxiseve/fLpQZ1H/vusada.pdf
- https://cdn.sqhk.co/lepavenujal/ixihhiu/51031491103.pdf
- http://buylettersonline.com/how_to_add_goals_in_workday1omfh.pdf
- http://zobotalemogi.sportsontheweb.net/how_to_adjust_throttle_on_pocket_bike.pdf
- http://help-verifiedbadgecenter.com/how_to_make_yourself_miserable_dan_greenburg_downloaddnx7c.pdf
- https://cdn.sqhk.co/lolitubafo/fgigchi/bebera.pdf
- https://cdn.sqhk.co/nejibija/jgijifI/phoenix_news_live.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://fasokefukolu.epizy.com/confluence_add_template_to_existing_page.pdf
- http://wajalapivibobi.epizy.com/5274826068.pdf
- http://gawekavadave.epizy.com/calendario_2018_y_2019_para_imprimir.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001a4b9.bin` `b59a1c17507d1213ab6ada329014f104c39ed485b0e02dd141017f8ec507b967`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1A4B9	5508 bytes
`font_01_sfnt_off0001b772.bin` `23f4c974544f763d604ab8393270bb7a16fb538ed08ef2910a96d3b084203669`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1B772	12120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.