PDF malware analysis — malicious · 86d86e91213d75fb

MALICIOUS

PDF

76.2 KB Created: 2021-03-07 21:10:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 1efc925f54c7e6ff969c0c4eb1187606 SHA-1: 72a87e84b94b1970f409c5ca4d2d37c62060853e SHA-256: 86d86e91213d75fb7d7a31223ef93115283c9a33689e868add924ff96d8140b1

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The document body, though heavily obfuscated, contains a reference to 'Spam call this number' and an external URI pointing to a URL that includes 'spam+call+this+number'. This suggests a social engineering tactic to trick the user into contacting a malicious entity.

Machine Learning

Nyx PDF Classifier malicious score 0.9960

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://bologen.ru/wix?keyword=spam+call+this+number
- https://cdn.sqhk.co/zifuvifiweva/6H9nEig/rainbow_birthday_cake_in_nyc.pdf
- https://cdn.sqhk.co/dofewijoras/cXTKibe/henry_survival_rifle._22._410.pdf
- https://cdn.sqhk.co/fopikudapom/hjca1Pt/36491639356.pdf
- https://cdn.sqhk.co/baxorurifina/gcoR4gf/business_manager_job_australia.pdf
- https://cdn.sqhk.co/sadirorig/b2Tiius/headshot_zd_survivors_vs_zombie_doomsday_mod.pdf
- https://cdn.sqhk.co/guwezasov/aid10wS/24409828597.pdf
- https://cdn.sqhk.co/loxinesupiva/jfl7nha/horizon_documentary_snowball_earth.pdf
- http://tamaxenipukeg.iblogger.org/residential_tenancy_inspection_report_alberta.pdf
- https://cdn.sqhk.co/nejajevafode/oggje9K/english_grammar_lessons_free_online.pdf
- https://cdn.sqhk.co/bexuxoxabim/DgfIbPd/koniwowokixolu.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/xupimaral/98211415442.pdf
- https://s3.amazonaws.com/latufenaw/bipowuzokekebadowamere.pdf
- http://libiwozurogufo.rf.gd/dadokodofopubijad.pdf
- https://uploads.strikinglycdn.com/files/3f7d9584-6099-4fd7-8cf1-582ab5a6439a/35274310565.pdf
- https://s3.amazonaws.com/waxapoz/sarukaduxirubiba.pdf
- https://uploads.strikinglycdn.com/files/a645842d-982e-4d60-b875-5332a8dee899/59888961920.pdf
- http://zotomogizolelaz.rf.gd/20322178621.pdf
- https://s3.amazonaws.com/lanubili/kegabusinu.pdf
- https://s3.amazonaws.com/bupaxomu/78278650683.pdf
- http://vunowobaxab.epizy.com/que_es_un_estado_de_derecho_en_que_nos_beneficia_brainly.pdf
- https://s3.amazonaws.com/xenavuxa/18704769717.pdf
- https://s3.amazonaws.com/kubafezin/how_many_types_of_psychological_disorders_are_there.pdf
- https://s3.amazonaws.com/jepinebawo/is_writers_work_reliable.pdf
- https://s3.amazonaws.com/jamuluvuvava/whats_the_3_day_potty_training_method.pdf
- https://uploads.strikinglycdn.com/files/20ae2917-99b0-466c-b679-18accf05caa4/is_there_a_cad_app_for_ipad.pdf
- https://uploads.strikinglycdn.com/files/97b69a74-5718-4841-bfdf-b256b5202061/52396008836.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ec8e.bin` `665ad217fc9e6c64d4fa558774edef48807694decd080ca5909534f19d11197d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEC8E	5416 bytes
`font_01_sfnt_off0000fec8.bin` `5b5a7d52028d544ede9006ec316d335dcae3fd2aad86283ab2c4aaa93589ff5b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFEC8	10688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.