PDF malware analysis — malicious · 4c3f0e9a3336400e

MALICIOUS

PDF

82.4 KB Created: 2021-02-15 10:33:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 347b9139736f515894978196973e51de SHA-1: 23a8e554b552b26e22f9eff5c702e444cf3870cb SHA-256: 4c3f0e9a3336400e952079bb1d681edeb3c60302429348729b16a5e67165e358

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://bologen.ru/wix?keyword=after+we+collided+pdf+espa%25C3%25B1ol', which is likely a phishing lure. While no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, potentially for credential harvesting or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://bologen.ru/wix?keyword=after+we+collided+pdf+espa%25C3%25B1ol
- http://ig-copyrightnoticehelp.com/24378365569eds7r.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/bepukuba/5248809737.pdf
- https://s3.amazonaws.com/vikukinumet/52636273390.pdf
- https://s3.amazonaws.com/damerirazib/99281313843.pdf
- https://s3.amazonaws.com/padadutiseni/ijazat_gulzar_song_remix.pdf
- https://s3.amazonaws.com/lanaladu/dreambox_learning_app.pdf
- https://s3.amazonaws.com/zuses/annual_free_credit_report_canada.pdf
- https://s3.amazonaws.com/fosalizuzu/xugozexobisubufilisaki.pdf
- https://s3.amazonaws.com/rumezo/4328358052.pdf
- https://s3.amazonaws.com/sabobenuwe/linkin_park_numb_piano_sheet_music.pdf
- https://s3.amazonaws.com/nefomojuwet/75459675932.pdf
- https://s3.amazonaws.com/bokofapig/43413144181.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- https://bit.ly/3hYaT
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dfe9.bin` `89548124150d14401ca470df4359db3f10d39475dbd1a89882ec7101c0656dbe`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDFE9	5444 bytes
`font_01_sfnt_off0000f246.bin` `f62c8ee4646a24964508f314c32503c6f4f3bd7c7845080111ab3ccd1149bfaa`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF246	2444 bytes
`font_02_sfnt_off0000fd0c.bin` `2ab18b8092c8b337721f126527017cfde65a13b18f4b658e665ef0f1486dcb74`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD0C	10592 bytes
`font_03_sfnt_off00012152.bin` `219a97d159c328ea9272cfef9089e087886a6580817ece466524d9fa86afcbe3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12152	17124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.