PDF malware analysis — malicious · 49e22be97274d1bf

MALICIOUS

PDF

82.8 KB Created: 2021-03-20 05:40:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 71c38f0c0e98ff200687c5a30d95a0c8 SHA-1: 902f59102d8e6346cde3e1e3681ea2c62ef051f0 SHA-256: 49e22be97274d1bfb6e97c913c204b240c1045ec467d75a3f748b741d1b2bd9d

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as a malicious PDF by multiple heuristics and a machine learning classifier. It contains an embedded URL pointing to a phishing site, likely intended to trick users into providing sensitive information. The PDF structure and embedded content suggest it's part of a phishing campaign, possibly delivered as a spearphishing attachment.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xajibur.ru/award?keyword=sample+business+introduction+letter+to+prospective+clients+pdf
- https://cdn-cms.f-static.net/uploads/4385011/normal_60554dce8d44c.pdf
- http://mukinumatonewo.getenjoyment.net/biology_class_12_book_download.pdf
- https://cdn-cms.f-static.net/uploads/4476577/normal_6044d1977c905.pdf
- https://cdn-cms.f-static.net/uploads/4401505/normal_60303e270a56b.pdf
- https://static.s123-cdn-static.com/uploads/4414336/normal_5fee70a9ab252.pdf
- https://cdn-cms.f-static.net/uploads/4459054/normal_601b999072497.pdf
- http://gezinuduwep.medianewsonline.com/16295572775.pdf
- http://nojigopagapusu.mygamesonline.org/suburik.pdf
- http://kufowawixapiva.sportsontheweb.net/casio_w-800h_change_time.pdf
- http://sikufitunowapon.22web.org/16949528277.pdf
- http://pofaduxiruk.getenjoyment.net/where_can_i_get_thanksgiving_dinner_to_go.pdf
- http://legegapepapo.medianewsonline.com/dish_remote_code_for_sony_dvd_player.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/satedafadusizo/42938560948.pdf
- http://jifisuxevizek.myartsonline.com/free_2nd_grade_book_report_template.pdf
- http://webixulibuka.rf.gd/base64_string_to_php.pdf
- https://s3.amazonaws.com/ruzumeb/66199658997.pdf
- https://s3.amazonaws.com/gumegulaxi/icewind_dale_2_complete_download.pdf
- http://wipadafefuxasi.onlinewebshop.net/biochemistry_and_molecular_biology_of_plants_free_download.pdf
- http://sogoxutagejuno.atwebpages.com/20954211232.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010672.bin` `cc76969967dc2f4a78978adb4f1fcad3dd7c0d84ba39a72b2962dfd3974dd6fc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10672	5604 bytes
`font_01_sfnt_off00011968.bin` `745717d6989b0a3e995389a889ca340b8b4515346db31b7fc36c05263221a5e2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11968	10472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.