PDF malware analysis — malicious · 9d326ab8352af730

MALICIOUS

PDF

77.6 KB Created: 2021-03-26 09:47:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: efa4b4af56aaded0415c2d0a0a21f1a9 SHA-1: 1646f627a4d42e71289888a048f1436b8a0725bd SHA-256: 9d326ab8352af730ea32ad07ef4275af784f7fef7f98df83537bea552f6a6989

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to trick the user into downloading malware or visiting a phishing site. The document body, though heavily obfuscated, contains text related to software downloads, reinforcing the phishing lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9991

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/strik?utm_term=asp.net+mvc+3+download+for+visual+studio+2019
- https://cdn.sqhk.co/ninuxoti/BigwChf/mini_battle_royale_code_muselk.pdf
- https://cdn.sqhk.co/niwexifa/c4T4jf6/kung_fu_do_fighting_hack_apk.pdf
- https://cdn.sqhk.co/dagosasojo/egeiLig/88501023272.pdf
- https://cdn.sqhk.co/vefuwebilux/1X2QxI4/37798841335.pdf
- https://cdn.sqhk.co/gopuxipo/ihhihgw/guess_tamil_movie_name_with_answer.pdf
- https://cdn.sqhk.co/wevujawej/qfgfiaR/live_talk_chat_apk.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/82288814-d96d-4b15-8035-02e090bbbbbe/a_matter_of_trust_lyrics_traducida.pdf
- https://s3.amazonaws.com/vanatul/dieta_para_aumentar_masa_muscular_hombres.pdf
- https://s3.amazonaws.com/zafaronivaj/zasufeziramejafeli.pdf
- https://uploads.strikinglycdn.com/files/b5d869b5-bb44-47d2-b485-ee41d079fc21/the_kid_who_ran_for_president_2.pdf
- https://uploads.strikinglycdn.com/files/55e4ee5c-9385-47eb-8f67-f942c85b7e0c/47819197909.pdf
- https://s3.amazonaws.com/sizadagazagaj/3683404040.pdf
- https://s3.amazonaws.com/zafaronivaj/10340728565.pdf
- https://s3.amazonaws.com/xozeb/56826867119.pdf
- https://uploads.strikinglycdn.com/files/84ef33e1-bd0d-4f33-8be5-f0ed081db047/kuluxipakoxidupuvujafi.pdf
- https://uploads.strikinglycdn.com/files/a0d1818b-e624-4942-853c-29d1391b1443/1996_jeep_cherokee_country_replacement_parts.pdf
- https://s3.amazonaws.com/zuponefi/chaos_theory_books_for_beginners.pdf
- https://s3.amazonaws.com/jopomodilamego/56523547562.pdf
- https://s3.amazonaws.com/wudibirewuduto/mcgraw_hill_earth_science_textbook_answers.pdf
- https://uploads.strikinglycdn.com/files/fe646ec9-e3ac-4048-a10a-1c67589592d7/joseph_campbell_the_power_of_myth_bill_moyers.pdf
- https://s3.amazonaws.com/marimejerebo/56298270842.pdf
- https://uploads.strikinglycdn.com/files/ec8b5d90-2561-4cae-82a2-7173bae64af5/where_do_you_learn_wilderness_survival_skills.pdf
- https://s3.amazonaws.com/dazifozixawus/3736321951.pdf
- https://uploads.strikinglycdn.com/files/caeeeb56-7464-4a79-9350-a92806746331/62162822417.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eeba.bin` `c7e315008e087bdb17b337d40790ab0a3e95ee908c3dac757398c053415bd2de`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEEBA	6120 bytes
`font_01_sfnt_off00010395.bin` `9fe146e2aec9cfedcccaee719bb59e5fc31c004a1113524daedeec560564cb68`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10395	10248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.