Malicious PDF — malware analysis report

Static analysis result for SHA-256 55cdb7f4084835ff…

MALICIOUS

PDF

74.3 KB Created: 2021-07-14 00:12:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-05
MD5: fc4b2b5d9e5673ab1487bf3276db4150 SHA-1: 7eedfe8007087fe444e2d8cd335c079e2ecdad9e SHA-256: 55cdb7f4084835ff86b93043257e6be5d9c814b290ea600ce9b59572a36c75b5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by a machine learning classifier and ClamAV as a phishing trojan. It contains multiple embedded URLs, one of which is associated with a known benign domain but is likely used as a lure. The PDF structure also shows duplicate object bodies, which can be indicative of obfuscation techniques used by malicious PDFs. No scripts were extracted, but the presence of embedded URLs and the malware detection strongly suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7746

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/0YvHz_IItD0/square?utm_term=short+note+on+s+block+elements PDF link annotation
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e8ca221b22c82f862d8140/1625868834691/did_adam_and_eve_have_sex_in_the_garden.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60edffce172ba47bdac76250/1626210254234/strawberry_blonde_james_cagney.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ec8d665f8bf969071e7608/1626115430497/email_cover_letter.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e840002d909c29a8321b19/1625833472658/about_ece_engineering.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c429.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC429 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000dc40.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC40 10548 bytes
SHA-256: 917b9a6b2154e096db7cbcf1fc108f7751aa658e3b261728f3eb88c1e79507fe
font_02_sfnt_off0000f415.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF415 15952 bytes
SHA-256: 74aecfd2e82ddb6131c0690f12daad7894c96a5f65fb574486d57839e4c5cc5d

Open this report in the interactive analyzer, or submit your own file for analysis.