PDF malware analysis — malicious · 51554a0be9a0c114

MALICIOUS

PDF

76.2 KB Created: 2021-03-25 12:53:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 49b563d6cb01c6e1c1621487aa11918a SHA-1: 4130b190b498a31a61abcacb4e8c3b0273d5121e SHA-256: 51554a0be9a0c114af072b05e87b429dd4a8e4b873e28e392ee791d9c9530a2a

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The document body, though heavily obfuscated, suggests a lure related to 'cancionero latinoamericano letras y acordes pdf', which is likely a pretext to direct the user to the malicious URL for a phishing or malware download.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/award?keyword=cancionero+latinoamericano+letras+y+acordes+pdf
- https://cdn.sqhk.co/zapakolozu/hciehdu/planet_pilkey_app_not_working.pdf
- https://cdn.sqhk.co/jopogoxom/giijdhc/vubepesepemik.pdf
- https://cdn.sqhk.co/toxinize/eihyBhh/4_pic_1_word_4_letters_cards.pdf
- http://bigowet.xyz/fosadivamununea14vk.pdf
- http://kzrovk.xyz/saxosolovosepis8f0hw.pdf
- http://xejopegig.mypressonline.com/malayalam_bible_stories.pdf
- https://cdn.sqhk.co/letarezetap/BgfBgji/jidetur.pdf
- https://cdn.sqhk.co/keropolor/hddKCnC/kitten_running_around_like_crazy_at_night.pdf
- http://baby-slings.ru/65848223014np638.pdf
- https://cdn.sqhk.co/kikolibub/tjcicQb/the_grim_and_i_apk_unlocked.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/dukajevo/9447359736.pdf
- https://uploads.strikinglycdn.com/files/b5f31428-cea6-44ad-a7a4-539e9bc32fce/kigavodurapomuxokum.pdf
- https://uploads.strikinglycdn.com/files/ab9b7848-ed91-4675-8622-a4484a7df249/why_wont_there_be_a_3rd_percy_jackson_movie.pdf
- https://s3.amazonaws.com/mafavuzenoliki/android_to_iphone_xr_transfer.pdf
- https://s3.amazonaws.com/vofadoloves/45006842337.pdf
- https://s3.amazonaws.com/satulibaren/tusibirumesat.pdf
- http://kilarosine.atwebpages.com/6522642817.pdf
- http://fadezanunadafik.myartsonline.com/wexovupo.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ea8e.bin` `f7fc621baf31eadd905bba60855fcb92eed992e59a958670e2c2084c8a5b45cb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEA8E	5308 bytes
`font_01_sfnt_off0000fc8a.bin` `244e596bcf04114bf10cc10700827d192eb4e91192e520909a3f4a8df13fced6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFC8A	11348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.