PDF malware analysis — malicious · 9e791237f920a71e

MALICIOUS

PDF

67.8 KB Created: 2021-02-27 21:42:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5eba9e0cca73729015aef0cb13a984e3 SHA-1: c927518b3bb0f51c9b727123f6761960870b9933 SHA-256: 9e791237f920a71ec7575965fbfc1f66aa22237c8dd0ee3d1c69efd55d108efa

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a lure related to a common household query, likely to trick users into clicking a malicious link. The embedded URL and numerous other URLs extracted from the document suggest a phishing or credential harvesting attempt. ClamAV and ML classifiers also flagged this PDF as malicious, indicating a high likelihood of malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/aws?utm_term=where+is+the+filter+on+a+dishwasher+located
- http://changepass.online/46384925193vlax3.pdf
- http://barashik.space/how_to_reset_whirlpool_fridge_after_replacing_water_filteramdtn.pdf
- http://safijejog.mygamesonline.org/how_to_set_a_plug_in_timer_switch.pdf
- http://kirakexig.mypressonline.com/36127000824.pdf
- http://linavaluviriv.getenjoyment.net/historia_universal_in_english.pdf
- https://cdn-cms.f-static.net/uploads/4427086/normal_60293eff8fd9a.pdf
- http://lianhua.life/how_to_determine_my_ip_address_windows_7dnmui.pdf
- https://cdn-cms.f-static.net/uploads/4388041/normal_5fd2bfec34fb4.pdf
- http://sudebatuwilazet.iblogger.org/44917474858.pdf
- http://itali-big.space/wiwavasozojakixulozezukmz41.pdf
- https://cdn-cms.f-static.net/uploads/4450151/normal_6039021383bda.pdf
- https://static.s123-cdn-static.com/uploads/4443799/normal_5fcc45688c27b.pdf
- http://cocobuka3.xyz/adfg_alaska_hunt_reportwmhk7.pdf
- https://cdn-cms.f-static.net/uploads/4372100/normal_6025dc2d16568.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://risuduk.epizy.com/login_animation_android_github.pdf
- https://s3.amazonaws.com/pirofopafu/96105168903.pdf
- https://s3.amazonaws.com/nazekisigiduz/consumer_reports_jobs_yonkers_ny.pdf
- https://s3.amazonaws.com/mudurixo/conduct_disorder_treatment_guidelines.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cd68.bin` `0a4e5b6e1970e985fbf251b373a32a6aeb84ba9c11919d94005ae79d6212c014`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCD68	5212 bytes
`font_01_sfnt_off0000df37.bin` `dfaa9bfa683d4c1fc190dcb95980e92c63a892ec8b856a09a411964a153fc08a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDF37	10188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.