PDF malware analysis — malicious · 72956ae7e4e0db5e

MALICIOUS

PDF

79.8 KB Created: 2021-03-24 00:29:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a9a8821ee5247ff528c9d4931260f865 SHA-1: 81039cf5709fd34e2a22bf375080a4fb33cf73da SHA-256: 72956ae7e4e0db5e5529fcf648ddd50764bc60830749804dd6a4b852761bcf53

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document flagged by ClamAV as a phishing trojan. It contains an embedded URI pointing to 'https://vilenefex.ru/wix?keyword=clep+natural+science+study+guide', which is likely a malicious link designed to trick the user into downloading further malware. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/wix?keyword=clep+natural+science+study+guide
- https://static.s123-cdn-static.com/uploads/4383687/normal_5ff09b714156e.pdf
- http://pifafixejizigu.scienceontheweb.net/73071154234.pdf
- http://tublitalia.space/tumblr_wallpaper_pastel_quotesbu63p.pdf
- http://govnosiakxws.online/antepartum_fetal_surveillance_20208icbf.pdf
- https://cdn-cms.f-static.net/uploads/4424672/normal_601ab882a2d89.pdf
- http://probnik1313.tech/17564049707dt87x.pdf
- https://cdn-cms.f-static.net/uploads/4488574/normal_6026a45576ed6.pdf
- http://fepemewavitik.66ghz.com/angularjs_route_templateurl_function.pdf
- http://justiciaforjustice.com/origami_cat_bookmark_instructions7kla9.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://lavaraf.epizy.com/secondary_school_vocabulary_worksheets.pdf
- http://saboveliga.myartsonline.com/tiduriberasoliwuw.pdf
- https://s3.amazonaws.com/somisilegex/97486628638.pdf
- https://s3.amazonaws.com/suxuzubojut/xujufebofavipixuwijuven.pdf
- https://s3.amazonaws.com/jojitagifuva/annual_leave_accrual_balance_sheet.pdf
- http://bimumebuzof.epizy.com/quran_apk_full_offline.pdf
- http://ditanumugagoma.myartsonline.com/municipal_solid_waste_to_energy.pdf
- https://s3.amazonaws.com/vovopafubipu/wivipipekujixesokelukax.pdf
- https://s3.amazonaws.com/juwofuxufijup/attack_on_titan_levi_past_movie.pdf
- https://s3.amazonaws.com/tazopaju/bebe_rexha_music_free.pdf
- https://s3.amazonaws.com/mawesenasijoser/95127507741.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f9e4.bin` `a68d1861b02420e8561708d472b939f4a52c0cc7e4af873453915ebc9d35566b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF9E4	5248 bytes
`font_01_sfnt_off00010bd3.bin` `58e8bb2caeaa94aec23d57753c76c37aac22bbcaf22c99b35e21d942a5cef699`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10BD3	10732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.