PDF malware analysis — malicious · 17e045a626bc4403

MALICIOUS

PDF

92.4 KB Created: 2021-07-22 00:07:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: 95703a71573b94cab42b515d80c509bb SHA-1: 37bc385665a0a2a665eaed82166ad1881b110809 SHA-256: 17e045a626bc4403efe5626661c2b2e9df0fd7f24e168d7636f35e2a4ba9ff38

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF was flagged by ML classifiers and ClamAV as malicious, with a high risk score. The presence of embedded URLs, despite some being marked as benign, suggests a phishing or credential harvesting attempt. The file's structure and classification align with common techniques for delivering malicious content via PDF attachments.

Machine Learning

Nyx PDF Classifier malicious score 0.9985

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://feedproxy.google.com/~r/sq/ugae/~3/XMoLd4EPXkg/square?utm_term=see+yourself+as+god+sees+you+josh+mcdowell+pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8beaed7702a4b9a6eccde/1625865902330/75768006281.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f34faf1db272198f9748a8/1626558383335/18825627296.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ecaa841951226b8b8ec3f3/1626122884487/defidojasutuzi.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee1fc2fb3cc800db5338b1/1626218434578/74650167200.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f1065d6e9a9a494aa3ccc7/1626408541175/45762147414.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f4ec15a3156f43f34561c3/1626663957149/i_just_need_a_moment_in_my_own_space_lyrics.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60edd9d9cb43530604a77606/1626200537503/betty_white_topless.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f4750c27519501fc1d8b1c/1626633484622/96929612320.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e91a555fa2eb14b90b713b/1625889365848/vufozutotizudek.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f5c40847ccd63035c779c3/1626719240794/electrical_machines_2_book_free_download.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e820cd5c1b846003418319/1625825485928/colour_drawing_book.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f3259f26e2e727c25f6cc0/1626547615956/66881283528.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60edbc8c221ba579b747952c/1626193037137/how_to_link_new_wii_remote.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f1d6b33dec2411fce7ef28/1626461876009/35987536843.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f328f0d68f3225905730b8/1626548464726/kubigubesigimetapinodefof.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee4399b1f8b9564886343b/1626227609604/timesap.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f88c8f8c7b33121df49e6e/1626901647781/eyes_running_all_the_time.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ee0812e03b615e0989ed69/1626212370524/salilupojo.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f88be1ed32df628a59ed19/1626901473700/rupekomutojojifafu.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8067446a8e17713e66a00/1625818740722/69562493046.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f388010b174908921093b0/1626572801793/best_combos_with_recon_expert.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60efcc0e161c06605435d587/1626328079053/64435926288.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f6723649ed543a17dbb470/1626763830232/16056698279.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e76f83c28cd26dec78accf/1625780099333/larry_smith_six_word_memoirs.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f58285731d8c7c6f175396/1626702469449/runoff_meaning_science.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000103fe.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x103FE	16792 bytes
`font_01_sfnt_off00011c10.bin` `e8e53509809e1fb1ef5da1cf745ca384c4d8765170d0212d3654721a7cef9622`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11C10	17000 bytes
`font_02_sfnt_off00014872.bin` `4c083b7ddb319bf35bed8bdfa1c483a5dd1d33873f2f9021b5c031d2a3d7ce99`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14872	11280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.