PDF malware analysis — malicious · 4e8c5c3e9d73170d

MALICIOUS

PDF

74.9 KB Created: 2021-03-04 05:13:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 4809dcfa421780b3ff282f387b6f1a9a SHA-1: d6bc8fb03d4d92e9fb1103e9fdf23b3edb23fe51 SHA-256: 4e8c5c3e9d73170d2318701375e82796df53faf455a8b0d29d1a78494a0f1a83

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a lure related to obtaining a motorcycle permit, directing users to a malicious URL. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. No scripts were extracted, but the presence of external URIs suggests a phishing or redirection attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/123?utm_term=how+to+get+your+motorcycle+permit+in+ms
- http://pagavopalubutu.scienceontheweb.net/is_apple_pencil_compatible_with_ipad_mini_5.pdf
- http://sugameloxufe.mywebcommunity.org/does_the_lexus_hybrid_require_premium_gas.pdf
- https://cdn.sqhk.co/lojadisexudo/FbhbnJU/somokemibawoguvexepavu.pdf
- http://nigoguno.scienceontheweb.net/zumugopajenezinofizib.pdf
- http://sawemawe.mywebcommunity.org/88275423161.pdf
- https://static.s123-cdn-static.com/uploads/4418788/normal_5fc7e40524b2b.pdf
- https://static.s123-cdn-static.com/uploads/4383304/normal_5fdea11a4fc7a.pdf
- http://bosemefawixuwov.mypressonline.com/gaduviz.pdf
- http://jijuduli.mywebcommunity.org/madame_bovary_movie_2000_trailer.pdf
- http://tokepubex.getenjoyment.net/sigma_1609_sts_setup.pdf
- http://fojukivijivik.medianewsonline.com/what_is_the_best_online_yoga_teacher_training.pdf
- http://tufodudem.mypressonline.com/61447732594.pdf
- http://metoxegid.mygamesonline.org/bodyboss_full_body_workout.pdf
- http://luwogexejel.getenjoyment.net/how_to_do_a_hard_reset_on_iphone_10.pdf
- https://cdn-cms.f-static.net/uploads/4377120/normal_601b3717308dd.pdf
- http://bikejesoxatelo.mygamesonline.org/2005_nissan_pathfinder_engine_price.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://dufojamimusim.atwebpages.com/sig_sauer_nightmare_cost.pdf
- http://kofaxafogi.myartsonline.com/jekijuwodoja.pdf
- http://lumosaneja.onlinewebshop.net/wikoliboga.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e733.bin` `8649613c7e30a68355d4c3c030298864e3cae688082b7ffdc1f101f37d86eb29`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE733	5196 bytes
`font_01_sfnt_off0000f8ee.bin` `72e3bbb7e1a9179b5a38b45ccd0af9b4ea27c68552b2e235dfbb7fea3c0435d1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF8EE	10832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.