PDF malware analysis — malicious · 3599be1742db2ddc

MALICIOUS

PDF

111.7 KB Created: 2021-03-28 09:25:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 48bdcd6158791198521045d6de980d7e SHA-1: ae9c1a6bffd99c561394726beaf50a1ba30b9fc3 SHA-256: 3599be1742db2ddc32ae76420ddd581e41c31b01a61177e4fcef7854545e7342

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, with a high risk score. It contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to trick users into navigating to a malicious site, which is a common tactic for phishing campaigns.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/123?utm_term=dmv+ny+online+manual+and+quiz
- https://cdn.sqhk.co/sujutowupolu/ijH8ihe/pofos.pdf
- https://cdn.sqhk.co/govazilose/Tihcphc/std_10_maths.pdf
- https://cdn.sqhk.co/buzomesil/ggicRIh/volenezedatazas.pdf
- http://zosuwalerikare.getenjoyment.net/88633144323.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://s3.amazonaws.com/getizar/96220367827.pdf
- http://zobatokuvanoz.epizy.com/9187361555.pdf
- https://s3.amazonaws.com/webipejonavuv/5303200715.pdf
- http://kipazafar.atwebpages.com/9359192302.pdf
- https://s3.amazonaws.com/baxunaf/bonosisekiki.pdf
- https://s3.amazonaws.com/ponivotigegepub/49132197940.pdf
- https://s3.amazonaws.com/tiluwisulepam/36671094334.pdf
- https://s3.amazonaws.com/tulosa/jisedabozolipaxojedoru.pdf
- https://s3.amazonaws.com/rodiligarexo/72556938800.pdf
- https://s3.amazonaws.com/kukupunopedon/22649837661.pdf
- https://s3.amazonaws.com/zufaxepixiguxax/international_journal_of_product_development_impact_factor.pdf
- http://datidalumoz.rf.gd/injury_report_patriots_vs_dolphins.pdf
- https://s3.amazonaws.com/wewuxuviwar/bypass_2._0_apk_link.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00016920.bin` `940ab19213471f79f080fc40d4686f99c8577cb2071323bd1977bc2611dfced0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x16920	4836 bytes
`font_01_sfnt_off0001797b.bin` `c248e1fc48f4b1798ea4ba2ba12d0509b3842d000806f7cda74c8da592816acd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1797B	12468 bytes
`font_02_sfnt_off0001a338.bin` `cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1A338	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.