PDF malware analysis — malicious · 2f49005f8a4db380

MALICIOUS

PDF

89.1 KB Created: 2021-03-21 06:05:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: f5f3508bd26f8de0020c5bf11715c1a7 SHA-1: 275dda1d26c539e5cbb157db4a8039aef836493e SHA-256: 2f49005f8a4db38068f64de3e13e4b8c150114ad49b5d602327303f87c7d81ca

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious. It contains an embedded URL pointing to a suspicious domain, which is likely used to host a phishing page or download a secondary payload. The document body, though heavily obfuscated, suggests a lure related to a synopsis, aligning with phishing tactics.

Machine Learning

Nyx PDF Classifier malicious score 0.9983

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/strik?utm_term=by+the+river+piedra+i+sat+down+and+wept+synopsis
- https://static.s123-cdn-static.com/uploads/4374369/normal_5ff46dea6e7d7.pdf
- http://abistrans.ru/kavuxapavutagalzvm0x.pdf
- https://cdn-cms.f-static.net/uploads/4425230/normal_602fa9c20d95c.pdf
- https://static.s123-cdn-static.com/uploads/4469136/normal_5fec018e5abcb.pdf
- http://loveantravel.xyz/the_chemistry_of_life_chapter_test_av51d4.pdf
- http://vinorama.fun/a_simple_favor_soundtrack_mp3_download9n6tg.pdf
- http://d2-club.ru/sofetavidiwed1fo1j.pdf
- https://cdn-cms.f-static.net/uploads/4369653/normal_6035a18ed7d84.pdf
- https://cdn-cms.f-static.net/uploads/4370561/normal_604cd4fca7d58.pdf
- http://voicebftyi.com/kezasumafozogowgg0e3.pdf
- https://cdn-cms.f-static.net/uploads/4449622/normal_5fd9b10916d23.pdf
- https://cdn-cms.f-static.net/uploads/4421199/normal_6023f0833cd6b.pdf
- http://xsale.trade/most_common_behavioral_interview_questions_redditumlef.pdf
- https://cdn-cms.f-static.net/uploads/4367622/normal_604199cb5a580.pdf
- http://kvrovk.xyz/406977337821yfz9.pdf
- http://bioforce-co.site/87893192731mqwq8.pdf
- https://cdn-cms.f-static.net/uploads/4387571/normal_60184dea502ec.pdf
- https://cdn-cms.f-static.net/uploads/4415950/normal_6026ed8391aae.pdf
- https://static.s123-cdn-static.com/uploads/4458625/normal_5fe1e9d2a35dc.pdf
- https://cdn-cms.f-static.net/uploads/4380867/normal_6038f0b6c62a7.pdf
- https://static.s123-cdn-static.com/uploads/4366313/normal_5ff6595c9aed7.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://uploads.strikinglycdn.com/files/78ae3641-bbd8-4c5b-8d8b-8b69a30d764b/example_of_motion_sensory_details.pdf
- https://uploads.strikinglycdn.com/files/29910022-4586-4cfb-9593-d603035200ec/9183474765.pdf
- https://uploads.strikinglycdn.com/files/f49cebab-e5ec-40e8-8f7c-9db247566508/mndot_gravel_road_design.pdf
- https://uploads.strikinglycdn.com/files/de0f9686-45b5-4b53-8d00-af25679a9ef6/42828267541.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f929.bin` `cc919d1b6b7e2dd2bbc6755974a713d5df69a3321bcf9ef04665721936a19d25`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF929	5104 bytes
`font_01_sfnt_off00010a98.bin` `f6d9cacf6defcda3e5c1e3bba4c45c16273cd04df126bfc29e059a207b3b18f4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10A98	11216 bytes
`font_02_sfnt_off000130f1.bin` `e93acd332f5893643511f4cefd38969ad5c744ad1b08842a788b6be7d277dd15`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x130F1	16204 bytes
`font_03_sfnt_off0001461f.bin` `0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1461F	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.