PDF malware analysis — malicious · 59154a2d996b05d3

MALICIOUS

PDF

76.0 KB Created: 2021-03-25 00:03:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ac7aa12e58a7587304ce23f4a0a9ec60 SHA-1: ea6ee8df220bc5354ccb95df5f2d9a090960c75b SHA-256: 59154a2d996b05d37209d6ee995043c78015324e0356a58453a88abe3df754ac

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, identified by heuristics and a machine learning classifier as malicious. ClamAV also detected it as a phishing trojan. The embedded URL likely leads to a phishing page designed to trick users into providing sensitive information.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://golowaki.ru/wix?keyword=schumacher+manual+battery+charger+se+82-6
- https://cdn-cms.f-static.net/uploads/4443809/normal_6023e50d341e8.pdf
- https://zuzilenew.weebly.com/uploads/1/3/4/5/134527977/zusofomofoxifol.pdf
- https://cdn.sqhk.co/fajoliteve/fiajfif/rosifidezuxamisuz.pdf
- https://cdn-cms.f-static.net/uploads/4393204/normal_6012bb3136f95.pdf
- https://fubabogi.weebly.com/uploads/1/3/4/6/134617409/remojonemumig.pdf
- https://kegibaxita.weebly.com/uploads/1/3/4/6/134661687/7c901.pdf
- https://cdn.sqhk.co/pubamegumox/ifjjKba/boyfriend_gift_plush.pdf
- https://cdn-cms.f-static.net/uploads/4409246/normal_5fdb1b5077168.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/5115fe52-236b-4adc-ac56-0835b0b8c570/lelipopubetifun.pdf
- https://s3.amazonaws.com/pizivurapab/99866001712.pdf
- https://s3.amazonaws.com/mibiwivanetuj/barojetajoju.pdf
- https://s3.amazonaws.com/miledu/zunorovumuv.pdf
- https://uploads.strikinglycdn.com/files/bbeb02ce-98a8-4bcc-a4af-3dfe280ef2a1/gardners_theory_of_multiple_intelligences_ppt.pdf
- https://s3.amazonaws.com/sowewazulejewi/28780624625.pdf
- https://uploads.strikinglycdn.com/files/fac64437-9c64-484f-a4ef-ef45790422a6/gps_garmin_60csx_manual_en_espaol.pdf
- https://s3.amazonaws.com/kawotexulozax/free_church_newsletter_templates_for_microsoft_word.pdf
- https://uploads.strikinglycdn.com/files/e310fc64-c1be-4abd-8ca5-d4e789b9d053/what_is_system_analysis_and_design_ppt.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e969.bin` `574161e74abc4097e549d148fd13be6a3f172a51ce8e941d7f6d9d5725cc9dc6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE969	6072 bytes
`font_01_sfnt_off0000fdee.bin` `501324786daeaa79e2d34527ca80e5f642bd32c355f42f6e248a7904259b99ae`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFDEE	10424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.