PDF malware analysis — malicious · 5e7ca1547c36de31

MALICIOUS

PDF

79.7 KB Created: 2021-03-17 19:33:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: f2fef12aff622ebcf90fd53e8618f102 SHA-1: d0997df99c81d2e98887d1a81be5167c34d52d64 SHA-256: 5e7ca1547c36de317e14e9f331abb1b5e69f5728287005c01a28b145b93a5664

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. The document body, though heavily obfuscated, contains text related to 'background check memphis tn' and an embedded URL pointing to 'botokaw.ru', suggesting a phishing lure. The presence of PDF-specific heuristics further supports its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/wix?keyword=background+check+memphis+tn
- https://static.s123-cdn-static.com/uploads/4417648/normal_60000e8891751.pdf
- https://cdn.sqhk.co/pirujezexod/zvbfgc1/slots_epic_casino_games_online_fruit_cocktail.pdf
- http://gifazat.iblogger.org/bulugebivewesawiref.pdf
- http://madamzero.com/minoruwozah45un.pdf
- https://cdn.sqhk.co/najafizox/Zjhjfja/pixel_gun_3d_wiki.pdf
- https://static.s123-cdn-static.com/uploads/4378608/normal_5ffb82f7c3c08.pdf
- http://fullhp.info/john_deere_l120_mower_deck_adjustmentfjtpv.pdf
- http://erogan24.website/gaunts_ghosts_wikiazudpz.pdf
- https://cdn.sqhk.co/doporaba/WhbjaMo/ding_dong_texas_population_2019.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://katevafitaga.epizy.com/how_to_treat_chigger_bites_on_dogs.pdf
- https://s3.amazonaws.com/rebomedug/4020913382.pdf
- http://mokodipixa.epizy.com/mammoth_ca_snow_report.pdf
- http://siwodonodefofo.epizy.com/bahubali_1st_part_movie.pdf
- http://seladetitogar.epizy.com/46895506240.pdf
- https://s3.amazonaws.com/jadudusujuje/comment_integrer_template_html_en_wordpress.pdf
- https://s3.amazonaws.com/gogunabones/28134689249.pdf
- https://s3.amazonaws.com/runuzitexokol/codici_catastali_comuni_italiani.pdf
- http://dunixojojulif.epizy.com/snack_ideas_for_diabetics.pdf
- https://s3.amazonaws.com/nigimul/zisegakuras.pdf
- http://futebupolidasuk.epizy.com/healthy_diet_guidelines_uk.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000facd.bin` `bfcb8f1681a09ffb3c1a21c014fd16540ccb18c825a797e4158f87fe7faa6ed2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFACD	5568 bytes
`font_01_sfnt_off00010d95.bin` `6b29204d9559866d69b47ddd3c219a89cd3e768c436f1f3a6b46b3ad22517c6b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10D95	10604 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.