PDF malware analysis — malicious · 813515f162160b19

MALICIOUS

PDF

83.2 KB Created: 2021-03-15 09:02:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 48f7c6b6c2a057daad9fb6e17d885885 SHA-1: 8403ce2678df645279bcdc53200dedf7a3f9d4b5 SHA-256: 813515f162160b19e515697127995ce54973e6b14e4d34af7bc06a4180584485

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document contains an embedded URI pointing to a URL that appears to be part of a phishing or malware distribution scheme. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it is designed to trick users into visiting a malicious site, likely to download further payloads or steal information.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/wix?keyword=more+practice+with+similar+figures+worksheet+answers
- http://rosutob.getenjoyment.net/fugasuxupiranune.pdf
- http://sewukagazub.mypressonline.com/kittel_solid_state_physics_solutions_chapter_2.pdf
- http://mixezitubut.mygamesonline.org/metal_cutting_blades_for_black_and_decker_jigsaw.pdf
- https://cdn-cms.f-static.net/uploads/4466680/normal_5fe8d07f543d6.pdf
- http://gejikojaki.scienceontheweb.net/pokukuwufimabatol.pdf
- http://xijivedijimidip.mygamesonline.org/calendario_escolar_2020_19_mexico.pdf
- https://miwebuzoz.weebly.com/uploads/1/3/4/0/134095964/kibuto_nijafifurovax.pdf
- https://fepobiwebefu.weebly.com/uploads/1/3/4/5/134592484/roretopabiruvifusew.pdf
- https://cdn-cms.f-static.net/uploads/4457582/normal_60263ed1e7d51.pdf
- http://pivolirarorip.mypressonline.com/seiko_westminster_whittington_clock_repair.pdf
- https://static.s123-cdn-static.com/uploads/4407991/normal_5ffa2d34a4688.pdf
- http://sosogemizibu.mypressonline.com/abrsm_music_theory_syllabus.pdf
- https://cdn-cms.f-static.net/uploads/4404757/normal_602a17df9dd18.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://sojufuka.atwebpages.com/2021_kawasaki_kx100_price.pdf
- http://pudosuvosav.atwebpages.com/kinetico_water_softener_price_canada.pdf
- http://xobebol.onlinewebshop.net/78280271867.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010837.bin` `7bf070ea082d4f5988ac4026ee3439ba1920f6950b5f920dc4f19efe10db891f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10837	5592 bytes
`font_01_sfnt_off00011b2d.bin` `4b7a0fcef18834c8f7ddddbf808f4609ef7245b9e92fc8a4a10a4f4393649715`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11B2D	10580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.