PDF malware analysis — malicious · a03138033c76cef1

MALICIOUS

PDF

97.6 KB Created: 2021-03-17 22:21:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: e1cbd801f836113f749b7f8105a19fc6 SHA-1: 7688a4f40fbce8a54573be50bb996fe842afc36e SHA-256: a03138033c76cef1ba2a6c4ca6970ed4c49848e1d14d036b1442eb007b643a06

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI that points to a URL associated with cancer treatment keywords, likely a lure for phishing or malware distribution. ClamAV and ML classifiers strongly indicate maliciousness. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to malicious sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://druttle.ru/award?keyword=tratamiento+para+cancer+de+pulmon+pdf
- http://gubinuwub.iblogger.org/add_text_to.pdf
- https://cdn.sqhk.co/fagevibe/YB7gfmA/3d_shooter_games_unblocked.pdf
- http://puloxev.iblogger.org/18697551740.pdf
- http://xewaxoweva.22web.org/kalekutujonezujamojoji.pdf
- http://dijepitezuk.22web.org/days_of_the_week_used_in_a_sentences_in_spanish.pdf
- https://cdn.sqhk.co/dudumadopole/gjaPmhi/tajukegezofigujigesop.pdf
- https://jezulusawuse.weebly.com/uploads/1/3/4/0/134000263/pijirixubateb-sizezor.pdf
- https://cdn.sqhk.co/nakunadubux/Djiianm/23017864442.pdf
- https://cdn.sqhk.co/woxiwovar/igjhjhL/lost_echo_resonance.pdf
- https://cdn.sqhk.co/mutobudenit/agihj3V/fun_facts_about_costa_rica_culture.pdf
- https://bopegaxuz.weebly.com/uploads/1/3/1/4/131406849/368334.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://tiwinifo.epizy.com/fedibenosuzebumizos.pdf
- https://s3.amazonaws.com/pusori/algebra_nation_workbook_answer_key_section_4.pdf
- http://bexukopelut.epizy.com/who_is_the_killer_in_the_killing_season_4.pdf
- https://s3.amazonaws.com/wobuzisibal/how_was_the_movie_the_birds_filmed.pdf
- https://s3.amazonaws.com/sigobija/gixokowuporolisupeloniru.pdf
- http://mafifupep.epizy.com/manualidades_halloween_para_nios_para_imprimir.pdf
- http://tefabonapo.rf.gd/bipogipemasatiganolafuxef.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- https://medlineplus.gov/spanish/lungcancer.html
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00013f12.bin` `bf41f09edcc3b2fd2711c1063f261cebcf00c96e23b03f067669eeae17871927`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13F12	5072 bytes
`font_01_sfnt_off00015038.bin` `e93e80429a82cbf5627b29a83c84baf2b75f80ad00927a398a3341985434661c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15038	12308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.