PDF malware analysis — malicious · 4c02d737d9088404

MALICIOUS

PDF

78.8 KB Created: 2021-04-03 02:39:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 09ac2fbda4654559d694d1bc22faa566 SHA-1: 9f5f5f31494637af38d69b9496aa95cb94dfc7dd SHA-256: 4c02d737d9088404447602e633f8098f5fe16f7df682722667f6639848d7a5e0

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a link disguised as a document about interview questions. This link, when clicked, redirects to a malicious domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://maypoin.ru/award?keyword=teacher+job+interview+questions+with+answers+pdf
- https://cdn-cms.f-static.net/uploads/4418013/normal_6022e700e8acf.pdf
- https://cdn.sqhk.co/bapisolel/hhibahi/party_music_playlist.pdf
- https://cdn-cms.f-static.net/uploads/4462362/normal_60232f1902387.pdf
- https://cdn.sqhk.co/dudugetogi/dfIu4hb/my_electric_meter_has_a_blank_screen.pdf
- https://cdn-cms.f-static.net/uploads/4449965/normal_605fb43310d05.pdf
- https://cdn-cms.f-static.net/uploads/4414502/normal_60622b1600c05.pdf
- https://cdn-cms.f-static.net/uploads/4426696/normal_6019cb7665f33.pdf
- https://cdn-cms.f-static.net/uploads/4369654/normal_6054551737028.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/46c5f5d8-1818-469e-8a12-046f8af1a91a/what_is_the_average_monthly_income_for_a_family_of_4.pdf
- https://s3.amazonaws.com/bagisi/tepafoguvefa.pdf
- https://s3.amazonaws.com/zupenafud/milijuwokososijawawazobi.pdf
- https://s3.amazonaws.com/medaliwifufugel/54840790688.pdf
- https://s3.amazonaws.com/poresi/c_interview_questions_geeksforgeeks.pdf
- https://uploads.strikinglycdn.com/files/4e113790-e9e8-44ee-9049-dd252ae1ddbe/30193895259.pdf
- https://s3.amazonaws.com/gedimuta/trinet_login_platform.pdf
- https://s3.amazonaws.com/naxozelozude/seleranolulifa.pdf
- https://s3.amazonaws.com/vebisop/androrat_apk_for_pc.pdf
- https://s3.amazonaws.com/lovomijelun/messenger_uptodown_new_version.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f546.bin` `56944046a931961e04e2d20862f5ffbcc441280eda2ef7cfd7ec360e08e49388`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF546	5652 bytes
`font_01_sfnt_off00010889.bin` `892ee0a86825b154a170396876b1d4972ff7591ce59b5867a95c2ec3f47eac92`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10889	10744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.