PDF malware analysis — malicious · 5e86bcc70e2daf06

MALICIOUS

PDF

71.2 KB Created: 2021-07-16 16:18:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: 751555a450702dc8e0eac621338a77fa SHA-1: f9cbc0fae7ad767c4d250aaade0064cbc79f2b41 SHA-256: 5e86bcc70e2daf0660254a22e971d6cf962ab2d8bb51ae87887315ff13721607

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was identified as malicious by a ML classifier and ClamAV, with the latter specifically flagging it as 'Pdf.Phishing.Trojan'. The PDF contains embedded URLs, one of which is associated with an Android aide tutorial, suggesting a potential lure for users seeking information. While no scripts were explicitly extracted, the presence of embedded URLs and the Trojan classification indicate a likely intent to deliver a malicious payload or conduct phishing. The document body is heavily obfuscated and unreadable.

Machine Learning

Nyx PDF Classifier malicious score 0.8753

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://feedproxy.google.com/~r/sq/ugae/~3/iCUEKX862tE/square?utm_term=android+aide+tutorial+pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8d520cb474813b85bdb21/1625871648109/illinois_property_tax_rate.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f13a56fcdff1298e560f00/1626421846493/i_get_up_i_get_down_new_song.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e7c8084d2175279d127bd6/1625802760657/ankle_still_swollen_after_4_weeks.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e81bdf51cb2a526cff1c34/1625824223189/24216603656.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e87d719656df6e24626c92/1625849201114/roman_number_of_72.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8aac76c9928302e0fb0e5/1625860807114/bibunutagiposived.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e941f6cc7c08645927dbff/1625899510989/degree_completion_letter.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b530.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB530	16792 bytes
`font_01_sfnt_off0000cd42.bin` `fb0418d23506ac53aabeb16d706bb2a986afda5b6657d67bd5a44b3d626527e8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCD42	16188 bytes
`font_02_sfnt_off0000f7bf.bin` `1d0653eade9331592229e0a3370fcc80a8d54b57a0c7edd067d2bac2452e03aa`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF7BF	10404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.