PDF malware analysis — malicious · 7cecc0584561b596

MALICIOUS

PDF

87.4 KB Created: 2021-03-30 02:53:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: d6bc21cc01c1fc98bfa13ec0472aa6c9 SHA-1: 31bce2e13911348ae0c6926540d9a41e2e98c450 SHA-256: 7cecc0584561b5960db85b42cc740ca139a9b2b5443ec4c6807eef10e2a26524

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to a suspicious domain, likely intended to deliver a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to 'sd card recovery apk app download', indicating a social engineering tactic.

Machine Learning

Nyx PDF Classifier malicious score 0.9993

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jumiwimov.ru/wix?keyword=sd+card+recovery+apk+app+download
- http://itdiscounts.info/lafisanodez5arq0.pdf
- http://899themes-demo.ru/84397977971ua90l.pdf
- http://dowamizu.iblogger.org/leguti.pdf
- http://myluckybet.xyz/manual_de_sincronizacion_de_cadena_dt9hhz.pdf
- http://moitender.org/xoxigigtydc7.pdf
- http://rawoxaxevog.mygamesonline.org/caisson_metod_ikea.pdf
- http://perevod24-card2card.site/94741079088b8i7o.pdf
- http://babubusawase.22web.org/network_engineer_interview_questions_and_answers_for_freshers.pdf
- http://argo-tourism.com/walamadutopogewenij7yaea.pdf
- http://faladen.22web.org/dijemeworuzumajogo.pdf
- http://votixowet.22web.org/kebipelotinozozu.pdf
- http://newyearshop.site/problemas_de_sistemas_de_ecuaciones_3x3_resueltos4szg4.pdf
- http://meetcabinets.xyz/bereket_emeklilik_ayrlma_talep_formu_rnei4dzp6.pdf
- http://lowufadit.scienceontheweb.net/count_your_blessings_chords.pdf
- http://naturalm.space/84263204430id1zt.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://vipebajivakal.epizy.com/54191144591.pdf
- http://terunakef.rf.gd/vugezizedigigofusexe.pdf
- http://wokesoz.epizy.com/silogibejokusu.pdf
- http://kujinid.rf.gd/what_is_marketing_management_simple_definition.pdf
- http://tuxolemoga.epizy.com/lurimo.pdf
- http://xukorigukem.rf.gd/70957035577.pdf
- http://mibavened.rf.gd/pulse_code_modulation_using_matlab.pdf
- http://norevevada.rf.gd/infosys_appointment_letter.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000116fc.bin` `b1b33d29af6d52a210144bacc90081f5ef9914ee3d2c268b77ee69399ea2ac22`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x116FC	5312 bytes
`font_01_sfnt_off0001293f.bin` `017a657dd260b4f734ec2485b84362938071e01901910eea82d80a48150d4b59`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1293F	11580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.