PDF malware analysis — malicious · 9a47d9458f00d929

MALICIOUS

PDF

75.1 KB Created: 2021-03-20 12:31:12 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e56caaa89df1071dd95651ceac2fa5ab SHA-1: b695624cd9b3940174511f45b993f5be4ed78f91 SHA-256: 9a47d9458f00d929a9d961903c168653fa6ca7053446fc3b2dcc0b496b11158a

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an external URI pointing to a suspicious domain, which is a strong indicator of malicious intent. The ML classifier and ClamAV detection further support this assessment. The document body, though heavily obfuscated, contains text related to baby sleep, suggesting a lure to a phishing or malware distribution site.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xezojetit.ru/strik?utm_term=how+long+do+babies+take+to+get+into+deep+sleep
- https://cdn-cms.f-static.net/uploads/4406789/normal_600ea6b23a2d5.pdf
- https://cdn-cms.f-static.net/uploads/4476122/normal_60190d8a64cf0.pdf
- http://gukivuzijisuva.getenjoyment.net/olympus_evolt_e-500_manual.pdf
- http://elinekici.online/31522231418n5lxl.pdf
- https://cdn-cms.f-static.net/uploads/4489601/normal_603b963cbed31.pdf
- http://fevofawemuwa.medianewsonline.com/xirizawu.pdf
- http://tumuduwaju.mypressonline.com/rivamofa.pdf
- http://dvigatel.guru/is_missing_411_on_netflixhujc3.pdf
- http://zanovekolasin.mywebcommunity.org/xesexo.pdf
- http://pawusewi.sportsontheweb.net/votisugipinuvupemageti.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://tulajadulixo.myartsonline.com/sony_vrd-mc6_specs.pdf
- https://s3.amazonaws.com/nodetuxapabara/76777870793.pdf
- https://uploads.strikinglycdn.com/files/a866577b-cb5b-4855-8863-034d056f9167/citizen_chronograph_wr100_price_in_pakistan.pdf
- https://s3.amazonaws.com/waduzirader/is_architect_safe.pdf
- http://lifobem.myartsonline.com/93712823310.pdf
- https://uploads.strikinglycdn.com/files/2d224d72-0b1e-4a9d-a6ca-a49a27bdd79d/1596871384.pdf
- https://s3.amazonaws.com/tajimipojimo/appellate_division_third_department_forms.pdf
- https://uploads.strikinglycdn.com/files/5df880e3-e3c6-41d8-9aac-1a071dd5894c/sebipipemugigabomedofoj.pdf
- https://s3.amazonaws.com/lerezazo/83355764578.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e7d6.bin` `43c677dee5691bd041186bb6766042c10344fb4e72eedb68f8dd4a0be89ff0a1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE7D6	5288 bytes
`font_01_sfnt_off0000f9f7.bin` `c0f5d5529d1aa4873a64433bd66855bb031732c0f3d9f31ee545f825de440290`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF9F7	10380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.