PDF malware analysis — malicious · 31635b455123dfa3

MALICIOUS

PDF

76.9 KB Created: 2021-02-21 09:59:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: feaedd8f6f6f8089e15792154e4212e7 SHA-1: b34248d1f22a22af7c50364e825ce81ec5afbf62 SHA-256: 31635b455123dfa3ccd5c5ec26b300a8801fe1c7f5c66139fa315fb32d2133fe

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://jacksth.ru/strik', which is a strong indicator of a phishing or malware distribution attempt. The document body, though heavily obfuscated, suggests it is masquerading as a legitimate document to trick the user into visiting the malicious link.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/strik?utm_term=what+kind+of+company+culture+do+you+thrive+in
- http://votatiji.22web.org/how_much_do_disney_stars_get_paid.pdf
- http://pafiwuz.66ghz.com/nike_socks_fitting_guide.pdf
- https://cdn.sqhk.co/vabalogu/jhEBZgj/tic_tac_toe_using_2d_array_c.pdf
- https://cdn.sqhk.co/nimabugokofa/OLIhieD/56706853947.pdf
- https://cdn.sqhk.co/wediximewoza/id6jg2w/insta_captions_for_first_pic_with_boyfriend.pdf
- https://cdn.sqhk.co/zasokolof/idgcifO/59535164532.pdf
- http://goldotzyv.ru/chatbot_app_android_studio0ypwl.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://jujijokupezuxis.epizy.com/wamijutilenutekakuvez.pdf
- https://s3.amazonaws.com/bagisi/minecraft_bedrock_mods.pdf
- https://s3.amazonaws.com/tubukeganuji/41816877850.pdf
- https://s3.amazonaws.com/xufoxorog/bully_lite_mod_apk_cheat_menu.pdf
- http://mipovigubebi.rf.gd/duvosibabas.pdf
- https://s3.amazonaws.com/xiwevitox/puduwotudenebek.pdf
- http://vepilezora.epizy.com/gpat_previous_question_papers_with_answers.pdf
- https://s3.amazonaws.com/xeruxaxer/atkins_fsico_qumica.pdf
- https://s3.amazonaws.com/vizegemawokaxe/tumawivob.pdf
- https://s3.amazonaws.com/rojalexipokadaz/bangalore_days_ringtone_bgm_free.pdf
- https://s3.amazonaws.com/womirofop/80616607217.pdf
- http://mitefunigesito.rf.gd/1714036727.pdf
- https://s3.amazonaws.com/bomupi/semilubideju.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ef5b.bin` `001e792ba37e447d728674d6e6ac98b186e204063bad6727268192208e0a4b78`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEF5B	5456 bytes
`font_01_sfnt_off000101d7.bin` `1ba552fe542db2ea58087df78d6ee06157e13f05903bfbd5c8557b6d37484e00`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x101D7	10616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.