PDF malware analysis — malicious · 9f43af464c7de83c

MALICIOUS

PDF

69.7 KB Created: 2021-03-25 01:25:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 8b55845b22b93e9634b2d454e8f14728 SHA-1: d27f87a84ca19c65bccd57784c6b533a6b254bb4 SHA-256: 9f43af464c7de83c36b1dbc6ff6fc0bac72ea16616f5cd3738310db02d3bf93c

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by ClamAV as Pdf.Phishing.Trojan and ML classifiers. It contains an embedded URI pointing to a URL that appears to be a lure for downloading a malicious PDF, disguised as 'digestion lab worksheet answers'. The presence of multiple suspicious URLs suggests a phishing or credential harvesting attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://botokaw.ru/wix?keyword=digestion+lab+worksheet+answers
- http://kipivejezijab.iblogger.org/nusaropitejerit.pdf
- https://cdn.sqhk.co/guzowozuk/cjfjggc/155608714.pdf
- https://cdn.sqhk.co/xomifinetepi/jc4gejf/legiwuge.pdf
- https://cdn.sqhk.co/simizekovogi/OojjUie/electrical_symbols_on_drawings_uk.pdf
- http://damapilob.iblogger.org/68257337658.pdf
- https://cdn.sqhk.co/lepowabog/tyigijH/download_rounded_corner_pro_apk.pdf
- http://bufo.online/83484062750psjwi.pdf
- http://sujolisake.medianewsonline.com/vefapinaluzibojanu.pdf
- http://tactical-jacket-sale.shop/jijifirulvi.pdf
- https://cdn.sqhk.co/dibirolinu/ja0yJii/adventure_waterpark_subic_entrance_fee.pdf
- http://voicebftyi.com/wedunibanebodawomanigorir78sq4.pdf
- http://fitavaluvonesix.iblogger.org/beatles_let_it_be_piano_sheet_music.pdf
- https://cdn.sqhk.co/fujalapevame/hcgh52W/origami_baby_clothes_instructions.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/e7414887-e3c5-4521-a130-d68533dd7a9f/opm_federal_holidays_2021_inauguration.pdf
- http://buzanuziti.myartsonline.com/xefibesi.pdf
- http://zapudeni.epizy.com/mugosoferaganijokuka.pdf
- http://fowimifefezujo.myartsonline.com/adeptus_titanicus.pdf
- https://uploads.strikinglycdn.com/files/30ebbd49-2689-44da-99dc-775bf75aa5de/14127993553.pdf
- https://uploads.strikinglycdn.com/files/dab87354-3f01-4be5-ab1d-21a2bf84f4cb/kutezepifeweba.pdf
- http://bixozebaxikapos.atwebpages.com/33794002021.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d1da.bin` `a5da59bf558159bb19a0ec6f6019761da10f757bb5c303c0269b9d616e87b8c8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD1DA	5240 bytes
`font_01_sfnt_off0000e3c4.bin` `a934678d4a80bd904d02ebc8f4974e458611357bb7d0058378ae59373fb177a9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE3C4	10584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.