PDF malware analysis — malicious · 53575296dba585e0

MALICIOUS

PDF

270.5 KB Created: 2021-05-16 05:48:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23

MD5: 8f7579032ecc025de17053560e247723 SHA-1: 24cfc37a54f2adf9be1843e86e20f0e937bf7daf SHA-256: 53575296dba585e0d8a18aff388c7f0f5f0aee7ef71febed236a39585f70089f

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body, though heavily obfuscated, appears to be a malformed attempt to mimic search result content, further supporting a phishing or social engineering attack vector.

Machine Learning

Nyx PDF Classifier malicious score 0.9467

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://lozipotod.ru/strik?utm_term=what+books+are+different+in+catholic+bible+have+extra PDF link annotation
- https://cdn-cms.f-static.net/uploads/4417314/normal_6033e5701947e.pdfIn PDF document text
- http://kakafeg.scienceontheweb.net/la_frmula_que_se_relaciona_con_la_ley_de_ohm_es_brainly.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4460708/normal_602875ca6ef5a.pdfIn PDF document text
- http://fuzuwozozat.mypressonline.com/lizisosuxusokokunogod.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4449618/normal_605c0436c6460.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4446399/normal_5fc811aea60c0.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4374372/normal_60462ff38e559.pdfIn PDF document text
- http://zukesijinizik.mywebcommunity.org/bharat_ratna_award_winners_list_download.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://73af689e-4c80-4f62-99d3-7a886641ad81.filesusr.com/ugd/3b5dd9_bdf9287b60de46dca73c22a415a3d96d.pdf?index=trueIn PDF document text
- http://padusij.onlinewebshop.net/how_to_bypass_a_rainsoft_water_softener.pdfIn PDF document text
- https://275320ff-96dd-455a-9699-a0fdc58b27a5.filesusr.com/ugd/943725_d839790d4f7a4114a4c9445ffd0d49d4.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/fujadabez/52638040719.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ef6cd3de-ce2b-4afc-8bfd-00b3357e3807/32115373050.pdfIn PDF document text
- https://436c154b-1c2d-4c60-9768-ed3a268ef5e1.filesusr.com/ugd/e8e253_5c25f90576984e57a3f3429b1692db45.pdf?index=trueIn PDF document text
- https://11484d69-1612-41b9-9199-165df1f08223.filesusr.com/ugd/e2f197_d78d4ae41cc540a685823de95939ff90.pdf?index=trueIn PDF document text
- https://uploads.strikinglycdn.com/files/64733d33-7d1e-4aac-8178-8ec3ba5a273f/34083983846.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6862078c-b711-4961-ae46-6ad15df805ce/crossfit_routine_with_dumbbells.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/15c27da9-b78b-4fe3-94d5-e4faacffeb7a/how_to_program_harbor_breeze_remote.pdfIn PDF document text
- https://s3.amazonaws.com/dikomavomem/kawojudosumafogumobakabor.pdfIn PDF document text
- https://s3.amazonaws.com/kifutizijebuj/cookie_sheet_pizza_dough_recipe.pdfIn PDF document text
- http://bidusibebawuz.onlinewebshop.net/venom_vs_carnage_comic_espaol.pdfIn PDF document text
- https://8d2868a3-57b7-484c-81f6-493c1c4f5daa.filesusr.com/ugd/a8ca0f_11e6d33d0fe8405492a932075e689541.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0003cf19.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3CF19	5244 bytes
SHA-256: `c00a0a46d8fb3e21d15f670dd3f5bcc5070743c428a8de8833333625462c19a9`
`font_01_sfnt_off0003e0ee.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3E0EE	11128 bytes
SHA-256: `b5100962420c3984800bf469fa94022fdb2f41526f3cfe45d296a3c6a44ecfcc`
`font_02_sfnt_off00040695.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x40695	16204 bytes
SHA-256: `532315dfdc59b350d447ad91845dd8cc72a836e684f536ab9a4305dc5b53fb8e`
`font_03_sfnt_off00041bc5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x41BC5	4324 bytes
SHA-256: `cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34`

Open this report in the interactive analyzer, or submit your own file for analysis.