PDF malware analysis — malicious · 3a26da1ea75def30

MALICIOUS

PDF

76.5 KB Created: 2021-03-21 00:57:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 0ae48dc16191024ce2259e96c340e1ee SHA-1: bc54470839e3fe4c20b680fb6287baa1d252b40a SHA-256: 3a26da1ea75def308fc1bdd207955b2b2677d431755044fb93a34f61ef0b4a50

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, which is highly indicative of a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly support its malicious nature. The document body, though heavily obfuscated, contains text related to 'To kill a mockingbird part 2 quizlet', suggesting a lure to entice users to click the malicious link.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ponafet.ru/wix?keyword=to+kill+a+mockingbird+part+2+quizlet
- https://buvokatawun.weebly.com/uploads/1/3/1/3/131378806/6044fae97cbf0b.pdf
- http://afracheat9.xyz/813915473023m60y.pdf
- https://gugamuwapubadek.weebly.com/uploads/1/3/0/7/130740318/figugaxil-worosezovowab-sopana.pdf
- http://jetiloxabutu.iblogger.org/autocad_2020_learning_book.pdf
- http://wokokijup.iblogger.org/24274028791.pdf
- http://funofuzifige.iblogger.org/51810333374.pdf
- http://salea.site/22740008012lsolh.pdf
- http://lasinonid.iblogger.org/17474764376.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/kujapomib/96928440193.pdf
- http://voxotili.epizy.com/12049378829.pdf
- https://uploads.strikinglycdn.com/files/5c5e394c-f25c-424f-b2a6-aef1c835d513/air_force_academy_sat_essay.pdf
- https://s3.amazonaws.com/vaxebisapesi/lagu_hanya_rindu_andmesh_kamaleng_lirik.pdf
- https://uploads.strikinglycdn.com/files/404c9cd5-1932-4eab-8279-e7deb74b342e/gaberosukovapofaze.pdf
- http://kizarepopudoso.epizy.com/fugexufidijuxopewejesome.pdf
- https://uploads.strikinglycdn.com/files/cb031834-2bc6-4d76-a92c-8b60d2682cbf/will_there_be_a_2021_ford_mustang_gt.pdf
- http://tasewegevatale.rf.gd/36958754938.pdf
- https://uploads.strikinglycdn.com/files/a35ab48b-6387-4781-ae47-8454198adab9/21743925636.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ed3e.bin` `565b1f94cb46d0379195dff1e444d55c0097bddf18c3c62ebca83f36833c5b0e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xED3E	5676 bytes
`font_01_sfnt_off00010071.bin` `688d1e905a73d733e9ffe1cb505f7d332074eb643af3612a9bcaa3487f89d1ec`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10071	10708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.