PDF malware analysis — malicious · 7a9b8f63c04df6f0

MALICIOUS

PDF

88.4 KB Created: 2021-07-22 11:47:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: 88d5d41bf1b34256f0cb51a908c025da SHA-1: 9c9b7df1d22bace40bdb4f4f0a0c433580e07536 SHA-256: 7a9b8f63c04df6f0badc210a3e6d67c2f62b2363e1a0f199ba95cf5c146582b6

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF was flagged by ML classifiers and ClamAV as malicious, indicating a phishing or trojan payload. The presence of embedded URLs, though many are marked benign, suggests an attempt to redirect the user to malicious content. The file's structure and heuristics point towards exploitation of PDF vulnerabilities to deliver a malicious payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://feedproxy.google.com/~r/sq/ugae/~3/0YvHz_IItD0/square?utm_term=wendy+monologues+from+peter+pan
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f631b3285ce460d19bfd20/1626747315376/xiphoid_process_pressure.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e91f080a287971af99e14d/1625890569041/3705948351.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f30ec89dfa584dc9db5e6d/1626541768766/51432919438.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f7ac0353df297156b425a1/1626844163869/tap_dancing_lessons_for_beginners.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f49451860d895b48359a8d/1626641490016/william_edwards_deming_theory.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f73f0b74819b0d1983681d/1626816267472/45992570069.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f57c6a29712869f08160d9/1626700906837/53555964648.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f39886699a8678c57e5377/1626577030945/baked_spare_ribs_with_bbq_sauce.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8c07b596d362fd0fbaa23/1625866363445/baxelejopapil.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f78c7924e1ff4810428463/1626836089513/1859081416.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60efd068bba06d2f3416cd63/1626329192509/65043609963.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f0b2976e32095df97cd809/1626387096186/direct_correspondence_meaning.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f3bf8c689a653fd29bd3a7/1626587021055/78571145447.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e7e81b46a8e17713e54eca/1625810971305/16998357404.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e88e0145094f692cda8f1b/1625853441303/lusemixelebenusanaj.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f0593a7d31e3667f6d68b8/1626364219477/40157558619.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ed36ca4918f36a6d5df3af/1626158794757/xufisazeporiziporuvux.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f72280ecabbd5b896e2415/1626808960593/track_and_field_rules_and_regulations.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f87b44896b5e2273aab1b3/1626897220629/39200413302.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e914ecc22c005c93382f11/1625887980581/marrow_meaning_in_malayalam.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60edb69742b2804958691c44/1626191512323/357251065.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e87d94aff2ee66166b14b7/1625849236632/road_to_hell_good_intentions.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e8886cf3a1f037b371aeaa/1625852013076/another_word_for_procession.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f147b4133357608f3db910/1626425268782/99251498852.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f66b.bin` `99cfef239b8ce563397a52fa5828736401e12b17cc6875c6e92c02b3fc75b87d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF66B	10956 bytes
`font_01_sfnt_off00010fa7.bin` `0404608fd3ecad967832446f487703faaee32484e9407f8ec4c6426b14823a3a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10FA7	16808 bytes
`font_02_sfnt_off00013ba7.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13BA7	16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.