PDF malware analysis — malicious · 973b306bb79b3076

MALICIOUS

PDF

94.4 KB Created: 2021-04-04 23:42:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3a5a554a6c26939dad0405c5b62ce07e SHA-1: 22b9fd87ff7b842972e184b658a3f2f2901e8de0 SHA-256: 973b306bb79b3076727a8927ef992ebce452106ce1910f7f88d91f33096822dc

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. The document body, though heavily obfuscated, contains text related to the Bhagavad Gita, suggesting a lure to entice users to click the malicious link. The presence of an external URI and ML classification strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.8495

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://golowaki.ru/strik?utm_term=bhagavad+gita+chapter+15+lyrics+in+tamil
- https://cdn.sqhk.co/jivazufevi/hdghjau/nomatuguzasu.pdf
- http://webpost.pro/trombosis_arteri_adalahwzjid.pdf
- https://cdn.sqhk.co/kigaratak/wnidRhi/happy_wheels_demo_unblocked.pdf
- http://sabowupab.iblogger.org/how_to_set_time_on_casio_g_shock_gd-100.pdf
- https://cdn.sqhk.co/tinajugezepi/RZuRNR5/super_word_search_puzzles_baking_christmas_cookies.pdf
- https://cdn-cms.f-static.net/uploads/4451574/normal_6038ecc216a42.pdf
- https://cdn-cms.f-static.net/uploads/4467278/normal_604915a31ae6e.pdf
- http://hookup154.online/pelofanoehtlv.pdf
- http://kobodesuwid.getenjoyment.net/pitelivonopulu.pdf
- https://cdn-cms.f-static.net/uploads/4485445/normal_6036f58bb4803.pdf
- https://zokeperivixif.weebly.com/uploads/1/3/4/3/134307771/b9e196a53.pdf
- https://fofelopuvamugav.weebly.com/uploads/1/3/4/7/134716477/dikixel_pajuwejofojap_dazoxob_pigirov.pdf
- https://cdn.sqhk.co/kesusevuzep/gfmigjc/62717620982.pdf
- http://didibemez.scienceontheweb.net/39134293694.pdf
- https://nibuxapevu.weebly.com/uploads/1/3/4/6/134601724/d1e0b7638d957.pdf
- http://fedorahosted.org/lohit
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://jozubukobuwaju.epizy.com/43067442376.pdf
- http://gogujigasad.onlinewebshop.net/rixejudagimagevawotuve.pdf
- http://scripts.sil.org/OFL
- http://www.geocities.com/mitra_anirban/hobbies.htmGNU
- http://www.gnu.org/copyleft/gpl.htmRegular

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_005_off00014a99.bin` `a028d7ef993b6e96d0a9752ffab96dfe1f460f00b3cc2181f99232c2597d57fc`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x14A99	15676 bytes
`font_00_sfnt_off000104e5.bin` `78b5d4879188dddab4f3267e8b425fa0bb194158091b6bf3f2f63d4479c8aa2d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x104E5	5876 bytes
`font_01_sfnt_off000118d1.bin` `9389eabb5da0f7ff5893e499ff791b47d46466a46589dcf6e6727fbd9e34bd63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x118D1	3772 bytes
`font_02_sfnt_off00012477.bin` `98dc25da42abd0d49742b3320d0c0d54d2a26759f9577ba9085879e9de6f4ff3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12477	12508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.