PDF malware analysis — malicious · 2d346c555fec0088

MALICIOUS

PDF

93.3 KB Created: 2021-02-28 09:56:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 36a9c503d7ba09ec2ce885bdf81841f6 SHA-1: 1aec8f62a2f363ae986f3e0ef5a6a39f5beee64d SHA-256: 2d346c555fec0088b0c9a38da5b945ddf64de8b912939a8c1c3fcc1f896bb658

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a phishing lure or further malicious content. The document body, though heavily obfuscated, contains text that appears to be a keyword search for 'sharpshooter kf2 guide', suggesting a social engineering pretext.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mezovuduw.ru/wix?keyword=sharpshooter+kf2+guide
- https://cdn-cms.f-static.net/uploads/4501660/normal_6023893d9ee5b.pdf
- https://cdn.sqhk.co/dawafawux/pidhf2W/60132957112.pdf
- https://cdn-cms.f-static.net/uploads/4424330/normal_600ae3aa8345b.pdf
- https://cdn.sqhk.co/pivokazi/aidjjEc/mimpi_basah_ketika_puasa_apa_batal.pdf
- https://cdn.sqhk.co/kodivitedi/jjwgcjb/epic_games_fortnite_account_settings.pdf
- https://cdn.sqhk.co/tisewesir/Njduidp/73536814817.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/zexozavo/sat_subject_test_dates_international_2020-21.pdf
- https://s3.amazonaws.com/xufaxoferugod/what_are_the_7_elements_of_music_with_definition.pdf
- http://ruguwozud.epizy.com/ejercicios_de_limites_laterales.pdf
- http://doriponesarom.myartsonline.com/11878579376.pdf
- https://s3.amazonaws.com/luworizesupox/cooks_single_serve_coffee_maker_instructions.pdf
- http://rukosivujuxu.atwebpages.com/18419194024.pdf
- https://s3.amazonaws.com/tupofelasujewas/engineering_failure_analysis_report_template.pdf
- https://s3.amazonaws.com/zafijukopa/causes_of_glioblastoma_multiforme_brain_tumor.pdf
- https://s3.amazonaws.com/bufexa/91763275791.pdf
- http://nopugorib.onlinewebshop.net/what_is_another_word_for_quite_a_few.pdf
- https://s3.amazonaws.com/vavejijitatofu/project_management_effort_estimation_template.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000131a2.bin` `7762217776130efa5c7149aa78de6d62c0a6f787fcee5e513e0e7aff48130fd9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x131A2	5572 bytes
`font_01_sfnt_off0001448e.bin` `95cea3bf308b8459c45b2fb09a8a4526072b5c9201cbcb2efbf8b6aaa6f96803`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1448E	10412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.