PDF malware analysis — malicious · 53915d5abaab9696

MALICIOUS

PDF

79.5 KB Created: 2021-07-19 15:25:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: 418f7cdf23140a6190c033d7a8183ca0 SHA-1: cb60affa43299497b7466bca026ea361af2252d6 SHA-256: 53915d5abaab9696e14ab0fd59cf4160dd19be10a1580783516da4b7da1f5743

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was identified as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The PDF contains embedded URLs that likely serve as lures for users to download further malicious content. Although no scripts were directly extracted, the presence of embedded URLs and the nature of the ClamAV detection (Pdf.Phishing.Trojan) suggest a phishing or trojan delivery mechanism.

Machine Learning

Nyx PDF Classifier malicious score 0.9511

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://feedproxy.google.com/~r/sq/ugae/~3/-MXWpcYQ7kA/square?utm_term=8+and+a+half+inch+penis
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e7e05f80504e0a7769aa41/1625808991318/ccna_notes_free_download.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f4ba5c22602c08ca001cfe/1626651229016/national_electrical_code_free_download.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e8efecb630645a0ef51d3a/1625878508506/rules_of_integration_multiplication.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f4b406a047b6361234618c/1626649606155/cm3_to_litres.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60eca12fc81c37306b318ea4/1626120495759/ways_to_stay_looking_young.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f33c4904a1d970179aa72a/1626553417362/watch_the_white_tiger_online_free.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e900dc3b7e7c63344ed65a/1625882845067/loose_watery_stools.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ec8b8720781e4bb11cc4be/1626114951424/isaimini_dubbed_movies_2019_download.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d4aa.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD4AA	16792 bytes
`font_01_sfnt_off0000ecbc.bin` `7e8608cc160c6ea08cbebe782eb1594e1e2e1b2feb1fb6788d08b44e14a80b11`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xECBC	17264 bytes
`font_02_sfnt_off00011a42.bin` `40221abeccbf794fa57d18ee3b2477f80abf295293017c82d8c857120f3c352e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11A42	10512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.