PDF malware analysis — malicious · 2270c5cf24ebdfff

MALICIOUS

PDF

72.1 KB Created: 2021-03-23 22:56:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b4f04e89a75ef6471fa57765d270222e SHA-1: e00c7b218d71320d5129f18bfba3b91b300b8db8 SHA-256: 2270c5cf24ebdfff5be28401731a3c390f8e452788e2ccc16673ecd4ca231b19

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified as malicious by ClamAV and an ML classifier. The document body, though heavily obfuscated, suggests a lure related to 'Base de datos algebra relacional pdf'. The presence of an external URI indicates an attempt to redirect the user to a potentially harmful site.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kuzutuzo.ru/award?keyword=base+de+datos+algebra+relacional+pdf
- https://cdn.sqhk.co/tifozeborot/hLUhfih/graphing_calculator_free_for_pc.pdf
- https://cdn.sqhk.co/fosuzonarefi/VRhiXmj/galaxy_s8_plus_verizon_android_pie.pdf
- https://cdn.sqhk.co/zotofoza/cSidCVc/81170167677.pdf
- http://givepamodugag.22web.org/69174542156.pdf
- https://cdn.sqhk.co/feneradebeza/jhSiehe/traffic_racer_bike_mod_apk_download.pdf
- https://cdn.sqhk.co/paxofipixag/djjbtzc/5493138870.pdf
- https://cdn.sqhk.co/jigavozef/ajfihgj/fowuxuzutoji.pdf
- https://cdn.sqhk.co/busekonel/jfihXhj/blackmail_scam_format.pdf
- https://cdn.sqhk.co/devepogisog/lgehdzD/battery_powered_led_christmas_lights_walmart.pdf
- https://cdn.sqhk.co/befulirawid/gceAiid/kaiser_urgent_care_pasadena_ca_hours.pdf
- https://cdn.sqhk.co/foxidagon/fgjjgBX/52032513992.pdf
- https://cdn.sqhk.co/zakolemafemo/jjshchb/92534287944.pdf
- https://cdn.sqhk.co/tovipovo/ij8jcYu/pararebuzegevanezuk.pdf
- https://cdn.sqhk.co/riwaxagi/ijjjjgf/php__server_remote_addr_null.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://bupiver.rf.gd/9352323443.pdf
- http://zilisugifep.epizy.com/telecharger_larousse_orthographe_gratuit.pdf
- http://suvibada.epizy.com/financial_ratio_analysis_example.pdf
- http://surafupomef.epizy.com/blend_for_visual_studio.pdf
- http://lewemezitena.rf.gd/kesej.pdf
- http://tafejedukevum.rf.gd/ipv6_subnet_calculator.pdf
- http://repoguter.epizy.com/weight_lifting_for_beginners_female.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d85e.bin` `6e8c01c4bb86d21d0ab4ef296d9977615f028987d65b3303da2331e55f90647a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD85E	5512 bytes
`font_01_sfnt_off0000eb29.bin` `71ef3272d776bebd0055ed86a48680db82a012afc3b1d1115ebb5ba7259c7b99`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB29	11768 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.