PDF malware analysis — malicious · 950bfc31b5c00052

MALICIOUS

PDF

76.1 KB Created: 2021-03-20 20:11:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 38d0d69410d4bf72ca29eb7ad9e52b27 SHA-1: 774212863fad792aa4f5c0dc1cd4f853868cd515 SHA-256: 950bfc31b5c0005269665d3f3d416e54ff23ce2efbecd78ab28248bfaae8d3dc

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL pointing to a suspicious domain. Heuristic analysis and a machine learning classifier strongly indicate malicious intent, specifically phishing. The embedded URL is likely used to redirect the user to a malicious site for further exploitation.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ponafet.ru/wix?keyword=estudio+biblico+sobre+el+verdadero+ayuno
- http://znalomstvavip.site/how_much_is_auto_mechanic_schoolrmnmr.pdf
- https://cdn-cms.f-static.net/uploads/4529095/normal_601229143879f.pdf
- http://vopagokiniki.mypressonline.com/eric_tupper_introduction_to_naval_architecture.pdf
- http://zugasanuko.getenjoyment.net/fingerstyle_blues_guitar_book.pdf
- http://dupigetibulira.iblogger.org/79427469132.pdf
- https://static.s123-cdn-static.com/uploads/4388426/normal_5ff7676bbf9e9.pdf
- http://it50save.info/strategies_for_technical_communication_in_the_workplace_free59c3u.pdf
- https://static.s123-cdn-static.com/uploads/4388420/normal_5ffd494bd46c1.pdf
- http://lebojabufi.medianewsonline.com/sexujaxujemexopevix.pdf
- http://jawirigagoboni.iblogger.org/antennas_and_wave_propagation_book.pdf
- http://lakshmi-store.ru/godaddy._com_website_templatesi41nt.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/bulolimepol/skyrim_change_load_order_vortex.pdf
- http://kokivifox.epizy.com/tutodosuxuve.pdf
- http://xalimelipuv.rf.gd/livro_dos_arquetipos_helio_couto.pdf
- http://jemileti.atwebpages.com/kukavejolofu.pdf
- http://lijaros.rf.gd/what_does_l_mean_on_ear_thermometer.pdf
- https://s3.amazonaws.com/fobupojowojon/xerorofeg.pdf
- https://s3.amazonaws.com/dujepav/dinuvoxegasevinomabewipij.pdf
- https://s3.amazonaws.com/sitozi/mubapudugidulapub.pdf
- https://s3.amazonaws.com/jumedemimo/writing_a_resignation_letter_uk_template.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e8a5.bin` `4aefd92d5bcf49996b92e86ff26ccd088a23c59db9909810407f623f6e13d449`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE8A5	5192 bytes
`font_01_sfnt_off0000fa69.bin` `92b688e5dab002663935e28a73fd08a984157a47bad8efb7bb49615059494e52`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFA69	12008 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.