PDF malware analysis — malicious · 1c49e4c2caac4b1a

MALICIOUS

PDF

78.3 KB Created: 2021-03-11 19:21:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 312b977a760c2c0bcb3282d53c939787 SHA-1: d938c802d025329038608500d394a5bf80ec493f SHA-256: 1c49e4c2caac4b1a42ef432bd56340e7c6ae29dad027d05f0c72738cdad6e485

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with the heuristic PDF_URI pointing to a suspicious URL. The document body, though heavily obfuscated, suggests a lure related to a 'Karcher pressure washer troubleshooting manual'. The presence of embedded URLs, despite the lack of explicit script content, indicates a likely phishing or redirection attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/strik?utm_term=karcher+pressure+washer+troubleshooting+manual
- https://cdn.sqhk.co/xibidodoko/AigdihO/myths_and_monsters_little_alchemy_2_cheats.pdf
- http://palawawez.mypressonline.com/99165191497.pdf
- https://cdn.sqhk.co/dajebala/iavlmjf/chess_royale_play_online_download.pdf
- http://degifutuv.scienceontheweb.net/17672616987.pdf
- http://kfnwejfnkwheklf.space/the_great_cat_massacrephox7.pdf
- http://sungo1.space/how_to_descale_a_nespresso_vertuoline_machinewbtny.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://nisetekotixob.myartsonline.com/29578767511.pdf
- https://s3.amazonaws.com/xomudufe/bacillus_licheniformis_in_agriculture.pdf
- https://s3.amazonaws.com/mokuwanibof/casos_para_assessment_center.pdf
- https://s3.amazonaws.com/lulelepese/38139238266.pdf
- https://s3.amazonaws.com/liluvad/39234730125.pdf
- https://uploads.strikinglycdn.com/files/756f1f02-2591-44bf-ad70-8f6fe2658baa/where_is_the_best_place_to_look_at_christmas_lights_near_me.pdf
- https://uploads.strikinglycdn.com/files/f4a92968-a76c-4e5e-a29c-89ae23265a98/bujemiwatalokejize.pdf
- https://s3.amazonaws.com/tibitexil/ccna_certification_exam_questions_and_answers_2018.pdf
- https://s3.amazonaws.com/zazelujeju/hangeul_master_ebook.pdf
- https://s3.amazonaws.com/buganabowumujef/3646267726.pdf
- https://s3.amazonaws.com/zoromexemuzid/47249336057.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f3ba.bin` `dd5d4122daa112af145744caa9bb569f9aa7bf98a495227d6708f7d50ea55109`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF3BA	5548 bytes
`font_01_sfnt_off00010681.bin` `3affe17f9025ecb8be1eee6c62603ec6a15d2cf949b743e4d2b8b29034d2ceca`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10681	11000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.