PDF malware analysis — malicious · a05fb0a4310afb66

MALICIOUS

PDF

81.9 KB Created: 2021-04-07 07:58:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a10d31fca0d9ec19a088cd952709c28c SHA-1: 69aecf22caa26729ff18dc9ec501cc834a720167 SHA-256: a05fb0a4310afb661bc8a9a0424ccd864020974db1a88d66920d88c869895d38

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains embedded URLs, with one prominent URL leading to a suspicious domain. The ML classifier and ClamAV detection strongly indicate maliciousness, likely related to phishing or malware delivery. The document body, though heavily obfuscated, suggests a lure related to 'book report format high school', which is likely a pretext to direct users to the malicious URL.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xezojetit.ru/strik?utm_term=book+report+format+high+school
- http://tgesheff.xyz/rudopuxutejimarokanasezocsia.pdf
- http://pearhaidhr.fun/556314357515lzux.pdf
- https://zanomegujinax.weebly.com/uploads/1/3/4/8/134873542/befodusajozufez.pdf
- http://55571.ru/how_many_cards_does_a_deck_have_without_jokersfy4hk.pdf
- http://bbflowers.net/which_is_the_best_mifi_routert2y5n.pdf
- https://nafuvazufu.weebly.com/uploads/1/3/1/4/131407552/mataxiwar_murofemibika.pdf
- http://kraftmann.su/68280570283w52ss.pdf
- http://reduslimitaly-official.website/84545966527nrpzu.pdf
- https://fawewetipe.weebly.com/uploads/1/3/1/3/131379545/9902448.pdf
- https://serewutedirafam.weebly.com/uploads/1/3/5/3/135339767/gemoge.pdf
- http://azalea.store/34818137273ggjmr.pdf
- https://lurafavef.weebly.com/uploads/1/3/0/8/130813461/sebifaz_vuzino.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/dewutexorob/xadolajil.pdf
- https://s3.amazonaws.com/lixuduwonifa/antimicrobial_activity_of_cinnamon.pdf
- https://s3.amazonaws.com/nijosinizo/logitech_k360_bluetooth_pairing.pdf
- https://s3.amazonaws.com/bejideba/apa_style_guide_book_amazon.pdf
- https://s3.amazonaws.com/norozovijalu/wisusujidozonelele.pdf
- https://s3.amazonaws.com/jonora/piano_sonata_no._16_in_g_major_op.31-1_beethoven.pdf
- https://s3.amazonaws.com/vifusupegiza/bluetooth_peripheral_device_driver_free_filehippo.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010279.bin` `39815f0351e7cee65ce85c6cd927dbd5c97f7540ebb549523a1e4398f884070c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10279	5540 bytes
`font_01_sfnt_off0001152c.bin` `4acecd5446983de0a8d17dc9accd5394d11d50621577ece220ca6c62edf1d651`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1152C	11328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.