PDF malware analysis — malicious · 85d2e57e14dd49f8

MALICIOUS

PDF

78.3 KB Created: 2021-07-14 07:19:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: 72acf70a57d6c0b8f06843bd7273134d SHA-1: 9b10384ee9333f86fa040aba9f17d7b4f0737fb9 SHA-256: 85d2e57e14dd49f844a685aa665ef5c419473a2bc40667788601ff8201a36937

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected by ClamAV as Pdf.Phishing.Trojan and an ML classifier flagged it with high confidence. The PDF contains an embedded URI pointing to a URL that, while currently marked as benign, is likely part of a phishing lure. The document body is heavily obfuscated, preventing a clear understanding of its specific content, but the overall indicators point to a phishing attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9478

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://feedproxy.google.com/~r/sq/ugae/~3/qQn0o4eTdIQ/square?utm_term=n2o+electron+dot+structure
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ee1be64d490f67274f5f1c/1626217446533/5919310090.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e894b9135e2e773a6f62f0/1625855161775/45553827396.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e87aec650ee476ad26adc1/1625848557104/how_to_handle_angry_customer_interview_question_and_answer.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60edddd50229956bd1342e24/1626201557661/decimal_to_mixed_number_and_improper_fraction_calculator.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ee5fc2462f394a1e448367/1626234818463/podubozofanej.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e864b2062e44289f3d4d01/1625842866443/batonuxotologeveteza.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ecfbd99b2242424e0095ca/1626143706012/work_breakdown_structure_for_hospital_construction.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60edb78ea5c02c6ff4dd0158/1626191758163/dodefipijiwozaz.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ccc4.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCCC4	16792 bytes
`font_01_sfnt_off0000e4d6.bin` `eef57f2f01da3106912b432c10fe3dc12561e9cda39c6add5fc9877323fa057d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE4D6	17860 bytes
`font_02_sfnt_off000113ef.bin` `249426bc76e8fc9238e734403f89be7d225b6a7111623dade183c9a8d5007cd6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x113EF	10308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.