PDF malware analysis — malicious · 20347cd41921f39d

MALICIOUS

PDF

75.5 KB Created: 2021-03-03 18:12:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-18

MD5: 3f4f9312e78ad29a5f6f127c857d0147 SHA-1: a9cf28d129fa9e76cee697e499d3bb6da88d2584 SHA-256: 20347cd41921f39d41682a151d164ae4cefe7b4ad3fb7935a45fbec7ac26035d

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xajibur.ru/strik?utm_term=biochemistry+textbook+medical+school PDF link annotation
- http://lulezuzebat.22web.org/how_to_get_your_debt_written_off_in_south_africa.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4413566/normal_6003888704582.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4460678/normal_60378357dfcc6.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4407782/normal_6002c9a17c5ba.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/sefipa/microsoft_flight_simulator_free_for_pc.pdfIn PDF document text
- https://s3.amazonaws.com/tupofelasujewas/86753856323.pdfIn PDF document text
- https://s3.amazonaws.com/taturi/wadaxifarenega.pdfIn PDF document text
- https://s3.amazonaws.com/sabobenuwe/film_afsana_pyar_ka_1991.pdfIn PDF document text
- https://s3.amazonaws.com/doxifuba/64225323249.pdfIn PDF document text
- http://masusekokuberex.rf.gd/google_sheet_gantt_chart.pdfIn PDF document text
- http://pijebikedil.epizy.com/strongs_concordance_hebrew_2023.pdfIn PDF document text
- https://s3.amazonaws.com/kavalukato/anakin_skywalker_transformation_to_darth_vader.pdfIn PDF document text
- http://kazewuwebam.rf.gd/21775562096.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eab0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEAB0	5604 bytes
SHA-256: `7396d635d38d37163a8ea140da0f4fa99f9d87937c0f5dd584e42cca70027f5c`
`font_01_sfnt_off0000fd98.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD98	10496 bytes
SHA-256: `4fe590fe794ad6baa0e7fddcb0b758677a3706b068aa673531ea9918757a8fd9`

Open this report in the interactive analyzer, or submit your own file for analysis.