PDF malware analysis — malicious · 5ab5c0d6c968d970

MALICIOUS

PDF

77.3 KB Created: 2021-03-12 10:39:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a4c127420a7abc12b82d7caec1b3e59b SHA-1: dd5580321dcc34a679181ffe14d9ffaf0105aaec SHA-256: 5ab5c0d6c968d970f4b80d247afc922b38f10df90f72ce09fcdeae9488cafb83

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by a ClamAV signature and an ML classifier, indicating a high likelihood of malicious intent. It contains embedded URLs that point to external websites, suggesting a phishing or credential harvesting attempt. The presence of these URLs aligns with the Spearphishing Attachment technique, as the PDF likely serves as a lure to direct users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://golowaki.ru/123?utm_term=esl+reading+worksheet+pdf
- http://anbieterbewertung-autoscoutch.com/213117877413e1u5.pdf
- http://mangalvpodarok.ru/72518596949jdzda.pdf
- http://zibanozoxepezu.iblogger.org/45083731805.pdf
- http://afracheat6.xyz/ryobi_router_table_base_plateolw4a.pdf
- http://myfirstsite.xyz/film_3_dara_full_movie_360psl9ms.pdf
- http://paselon.getenjoyment.net/wopudumagavetatepami.pdf
- http://milanbeachs.space/12040137230ez8x2.pdf
- http://xokebidukefu.getenjoyment.net/3917992339.pdf
- http://pubguckazan.com/pevuxemigesixedonu9wkjd.pdf
- http://obuv-kozha.ru/7086609868493x0m.pdf
- http://dujekuba.22web.org/64072892922.pdf
- http://alex-travel.moscow/13935292799c0r6w.pdf
- http://dazanewuxizelen.22web.org/hp_pavilion_27_all_in_one_review.pdf
- http://meetchat.space/birthday_photo_collage_maker_appe6wui.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://aefbb2f1-1cfc-4a48-aab2-d72547d84173.filesusr.com/ugd/2f3ac6_287f4be330f14c14aa74f946e64d2526.pdf?index=true
- http://womawujun.atwebpages.com/capuleti_e_montecchi_libretto.pdf
- http://zifasodokid.epizy.com/best_rpg_maker_games_on_android.pdf
- http://xajulazozu.epizy.com/pollen_grains_are_formed_by.pdf
- https://27aa3d6a-fcc1-4574-a8e0-77dd5bf64dcc.filesusr.com/ugd/7683ec_6b9729049bd04fd4994b3a0ba40809d6.pdf?index=true
- http://fawivemepogu.epizy.com/rpf_constable_2018_answer_key_group_d.pdf
- http://zimemotom.rf.gd/frontier_ct_tv_guide.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000efa0.bin` `d71f78f03c583869d78d6d3b8c49a5d6a1144804e274aff8c58472a99e1f4531`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEFA0	5416 bytes
`font_01_sfnt_off0001021b.bin` `81953f77e941d7e5492da6876adad5153e42f3a8f33c524e5aaf701ff8008af9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1021B	10920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.