PDF malware analysis — malicious · 1b5e5d14780105a3

MALICIOUS

PDF

77.4 KB Created: 2021-03-27 11:43:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9ecdfc0d45a0af1d018444615e5cbb28 SHA-1: dab5e74366378c627921c6bda6a4e28e1bcc7416 SHA-256: 1b5e5d14780105a31be2af47542e43da9e8350783d2369b0a5053118c663b3fd

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that mimics a search result, likely intended to trick the user into clicking it. The ML classifier and ClamAV detection strongly indicate malicious intent, with the PDF_URI heuristic pointing to a specific phishing URL. No scripts were extracted, but the overall structure and heuristics suggest a phishing lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ponafet.ru/strik?utm_term=nordictrack+c800+parts
- https://cdn.sqhk.co/lojosexotak/Jgijizd/rejedowaripitebatogobusuk.pdf
- https://cdn.sqhk.co/jeforije/jbJhahi/xofazixogopupe.pdf
- https://cdn-cms.f-static.net/uploads/4391620/normal_6056d0f64c825.pdf
- https://cdn.sqhk.co/xorazasuno/kidrRjd/aimpoint_t2_scalarworks.pdf
- https://cdn.sqhk.co/tejosepu/fkigfig/2017_football_cards_worth_money.pdf
- http://midikakuvekume.mywebcommunity.org/pojegeralubibivivinokuzar.pdf
- https://cdn-cms.f-static.net/uploads/4418197/normal_605c4ebc39b84.pdf
- https://cdn-cms.f-static.net/uploads/4482617/normal_60281e41f23a1.pdf
- https://cdn-cms.f-static.net/uploads/4382948/normal_60199f0b12936.pdf
- https://static.s123-cdn-static.com/uploads/4405639/normal_6005174607c20.pdf
- https://static.s123-cdn-static.com/uploads/4422890/normal_5ff0347f3f0e8.pdf
- https://cdn.sqhk.co/setupemup/9uKhpib/17283193216.pdf
- http://desajegurake.scienceontheweb.net/r_language_tutorial_point.pdf
- https://cdn-cms.f-static.net/uploads/4449405/normal_6057f67fafdac.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/15ebd9ab-e1fb-46c3-a905-ab97c13059cc/21943645009.pdf
- https://uploads.strikinglycdn.com/files/16248ce5-9bf4-4874-8256-c4f283a40546/saltwater_fishing_rods_for_sale.pdf
- https://uploads.strikinglycdn.com/files/89a5470e-3d11-4507-8d3e-8a434baa96ee/wudij.pdf
- http://pizitibasowu.atwebpages.com/23505206888.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eeb7.bin` `ed8e4a4cbc4f5408c6093aae51f82943db38f1d74328558c108d3cd42f7cfba7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEEB7	5404 bytes
`font_01_sfnt_off00010126.bin` `8afcf4fbfee83b1444809612f9c4a4f1e4f53636be6ec1406f6452c29f4cdb49`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10126	11700 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.