PDF malware analysis — malicious · 7019f1e6368d05c1

MALICIOUS

PDF

76.4 KB Created: 2021-03-17 05:47:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9dc7fb7adb684b937eb8ba3c80174cd0 SHA-1: 5341e65d0d975fdd17a977c8be28c52228fde6de SHA-256: 7019f1e6368d05c159cadb549b6378746a59e1592fda793fdafaf6af3a3dbcfc

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that directs users to a suspicious domain, likely for a phishing or malware distribution attempt. The document body, though heavily obfuscated, suggests a lure related to 'boiler water test pdf'.

Machine Learning

Nyx PDF Classifier malicious score 0.9991

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://soxebez.ru/award?keyword=boiler+water+test+pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/vovuzize/jelodiretarulop.pdf
- https://uploads.strikinglycdn.com/files/47217b77-b2a4-4fe4-9952-73fe26aa67c9/sony_ht-ct780_manual.pdf
- https://s3.amazonaws.com/zurovajij/boy_scouts_personal_management_merit_badge_pamphlet.pdf
- https://uploads.strikinglycdn.com/files/ecc05364-d8ba-4e9a-943d-d0a29d7150cd/vozuzetususolasuwe.pdf
- https://uploads.strikinglycdn.com/files/9c6a5bbf-3fc6-4162-91e2-10e7795e8e69/2018_ap_human_geography_exam.pdf
- https://s3.amazonaws.com/borokegujuzero/kesoridaperu.pdf
- https://s3.amazonaws.com/febopa/best_free_responsive_blogger_templates_2019.pdf
- https://uploads.strikinglycdn.com/files/d3da13de-14ab-4585-88f3-f38e394d6ced/dd-wrt_modem_router_list.pdf
- https://uploads.strikinglycdn.com/files/c61a6c91-2c13-4e0d-a907-f448ba0e3cb8/digobozijonebizefukirotob.pdf
- https://uploads.strikinglycdn.com/files/62b31835-15da-4c6b-ba50-3187bced9f41/2539307506.pdf
- https://s3.amazonaws.com/wefadep/foods_high_in_uric_acid_chart.pdf
- https://s3.amazonaws.com/varolexexus/73142333868.pdf
- https://uploads.strikinglycdn.com/files/e7819aa6-54fb-4f41-924a-50e819e78bcc/xuwazunasopokig.pdf
- https://uploads.strikinglycdn.com/files/c42d263e-bf8d-41c9-bbb2-34883666afb5/95370675784.pdf
- https://uploads.strikinglycdn.com/files/30a9cace-8f1b-45a0-910b-c9a77bcfaf46/zinokiwavosuva.pdf
- http://dasiletu.epizy.com/code_erreur_playstation_ce-33992-6.pdf
- https://uploads.strikinglycdn.com/files/7d7d1735-27c5-4531-9f12-76f0c2aaaef0/bofubolubimimokowowusonij.pdf
- https://uploads.strikinglycdn.com/files/34875ca6-cfae-49a9-940d-acf188b035db/what_is_ishmael_in_the_bible.pdf
- https://s3.amazonaws.com/vibuvomomuv/literary_devices_practice_worksheet_answers.pdf
- https://s3.amazonaws.com/gavapozalilup/twitter_app_latest_version_free.pdf
- https://uploads.strikinglycdn.com/files/2690d294-4297-4e4a-b4cb-7647f1394674/how_to_hear_tv_through_headphones.pdf
- http://nuwixunosozi.epizy.com/sociological_perspective_of_religion.pdf
- https://uploads.strikinglycdn.com/files/64d9be88-51e5-43e9-88e7-e14719792e74/myron_mixon_brisket_injection.pdf
- http://lamuzanumezaw.rf.gd/ampyra_package_insert.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eed9.bin` `2e6bea5803a8ea7c0abdf6a97407eb8e35c3d6285e98bd5c1241b388404f1031`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEED9	5176 bytes
`font_01_sfnt_off00010097.bin` `42aa4b2c9b814fd67507615567867ae0632f85a59050ef32ee6220afeca53fc8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10097	10444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.