PDF malware analysis — malicious · 20596c1125da22d2

MALICIOUS

PDF

76.3 KB Created: 2021-03-14 16:11:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 58aac8d9f81c39bbc0203b4e33a8b0ce SHA-1: 20c9dbdcad5a4c5dd1003cea60ce8ebf984eace5 SHA-256: 20596c1125da22d285ad217f187db91bb24fca69c8a1b27b7acde26cdcb1e3c8

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to a suspicious domain, likely intended to trick the user into visiting a phishing or malware distribution site. The document body, though heavily obfuscated, contains keywords related to the embedded URL, suggesting a lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9272

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/award?keyword=beam+ends+errol+flynn+pdf
- http://fabujisaw.mygamesonline.org/92307763179.pdf
- https://cdn.sqhk.co/mivufarowiwi/gjb5Rgc/zetixejewirafimewijeduje.pdf
- https://cdn.sqhk.co/pugirunosamo/icmhhig/75628828335.pdf
- https://cdn.sqhk.co/bidamasegom/b90Mjh6/71080282968.pdf
- http://vibolofisef.mywebcommunity.org/foseneviwumedisar.pdf
- http://zazorin.scienceontheweb.net/which_is_the_coldest_city_in_the_world_right_now.pdf
- https://cdn.sqhk.co/wubukuxivupe/giaV3tN/fowitu.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/f840ac34-31dc-4c95-9911-6de496bbb3df/15569600780.pdf
- https://8d94caac-80d5-4f6d-a73a-04ed47837dc1.filesusr.com/ugd/585b1d_231253c4a750413b8e565a5097115de8.pdf?index=true
- https://uploads.strikinglycdn.com/files/8252c645-9c09-4370-8874-9230cad9872b/geveko.pdf
- https://uploads.strikinglycdn.com/files/cc1933df-ae7b-4c71-b74d-1a519bf3da2e/58364435637.pdf
- https://1cdd1dcb-54a5-4750-95ad-c4cce9a68cd1.filesusr.com/ugd/1e32c2_5b3bd27c961943e283735e1273fb60ae.pdf?index=true
- https://s3.amazonaws.com/vonutavekip/pabosis.pdf
- https://s3.amazonaws.com/xifabilejilab/lewudugejorenoloxax.pdf
- https://0b609444-e5a2-4a7e-9779-a3c6bae51a53.filesusr.com/ugd/529dbf_27475f90f5a44c29ba5508ee37493f53.pdf?index=true
- https://uploads.strikinglycdn.com/files/8481a042-e782-4ee1-b27c-7cd731d5e2b1/jenn_air_convection_oven_replacement_parts.pdf
- https://181f3bdf-810f-4c34-abb3-9f3362228cd6.filesusr.com/ugd/30415f_3ff8f2c265564cd8b72c3d9336289ac8.pdf?index=true
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e91e.bin` `06c923d45c625cbbf036d8f37165e5cc001619cb38611d647d0c254645954467`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE91E	4996 bytes
`font_01_sfnt_off0000f9ff.bin` `32f4005def7b9c4b6104bff6eb30956412d2fb2d60f65beb487ab436ab66ccea`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF9FF	11744 bytes
`font_02_sfnt_off000121c2.bin` `ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x121C2	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.