PDF malware analysis — malicious · 938c03a704364fda

MALICIOUS

PDF

84.1 KB Created: 2021-03-14 12:23:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7a36d9d56027520c91835b1fcbdc773b SHA-1: 7f0bac3123ae8d629a3e5dd59545f66ee58a0547 SHA-256: 938c03a704364fda89cfcf0ac8190892fd785b5986e5c25b35ffdc993b79df98

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'resalured.ru', which is likely the malicious destination. The document body, though heavily obfuscated, suggests a 'Clipsal catalogue' lure, aligning with a phishing attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/123?utm_term=clipsal+catalogue+pdf
- https://cdn.sqhk.co/retagigimusa/0jdgEie/zupagetufipuzonobupem.pdf
- https://cdn.sqhk.co/tezizejaropu/fM9Pihq/qvc_free_shipping_on_everything.pdf
- http://bikelumonekodex.mygamesonline.org/ards_treatment_guidelines.pdf
- http://jenirafona.22web.org/74262075103.pdf
- http://mebovedu.getenjoyment.net/banking_regulation_act_1949_notes.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/zerejibixupav/keurig_b60_water_reservoir.pdf
- https://s3.amazonaws.com/xovekolamoxe/riferanob.pdf
- https://s3.amazonaws.com/bejeseja/difference_between_antiparallel_and_parallel_beta_sheets.pdf
- https://s3.amazonaws.com/kefodek/kepitogubegopedozokupesas.pdf
- https://s3.amazonaws.com/dazuxujepov/pegilepepisevabega.pdf
- https://s3.amazonaws.com/dazuxujepov/jukomamazer.pdf
- https://s3.amazonaws.com/nopomewegobij/21133740080.pdf
- http://ximuxulizi.myartsonline.com/the_unit_girl_group_name.pdf
- https://s3.amazonaws.com/zoluwivebiro/50029963016.pdf
- https://s3.amazonaws.com/dukavunivifa/lifuxajalek.pdf
- https://s3.amazonaws.com/datarofapakil/hangout_link_for_ipad.pdf
- http://detekoxinusogux.epizy.com/lomogalaxe.pdf
- https://s3.amazonaws.com/pobixedele/71843001973.pdf
- http://guxenubegipus.epizy.com/interior_design_career_salary.pdf
- https://s3.amazonaws.com/vudivuzakal/vimuxipizobazegenenenozad.pdf
- http://fuzadakeju.epizy.com/50297138499.pdf
- http://liforese.epizy.com/kedobanikosop.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010abc.bin` `b5f4060ce2dee21e58ffd23ca13f499ff7bad3d74c9f53e8016e9f0376de722b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10ABC	5132 bytes
`font_01_sfnt_off00011c47.bin` `49c556d56be0f64d2f5561fdbd21965ffa2310fb796a9e897caa170f8ae30b9e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11C47	11992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.