PDF malware analysis — malicious · a159171e1686439e

MALICIOUS

PDF

208.6 KB Created: 2021-05-24 06:54:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07

MD5: a3a72b7814a369092e6456522ceedd35 SHA-1: 0baef260449ceef6a05746e5d85ad80448485200 SHA-256: a159171e1686439ea5dbd6bf41286cb354ad4f212b880d926de07045cc212cb4

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as Pdf.Phishing.Trojan. The embedded URL leads to a suspicious domain, likely intended to host a phishing page or download further malware. No scripts were extracted, but the PDF structure and embedded URI indicate a phishing attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9825

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/strik?utm_term=what+is+bhagavad+gita+in+english PDF link annotation
- https://lasebotoxuxuxir.weebly.com/uploads/1/3/4/7/134729765/zaxuloja-pirib-donis.pdfIn PDF document text
- https://mulofujuxemo.weebly.com/uploads/1/3/0/8/130874025/nososa_sofogavabenit_zuliw_sivosedilobopu.pdfIn PDF document text
- https://banatili.weebly.com/uploads/1/3/5/3/135314160/3055650.pdfIn PDF document text
- https://nowigusoludi.weebly.com/uploads/1/3/4/2/134266380/8303399.pdfIn PDF document text
- https://nibuxapevu.weebly.com/uploads/1/3/4/6/134601724/611116.pdfIn PDF document text
- https://dotanivim.weebly.com/uploads/1/3/4/7/134705276/a6931b.pdfIn PDF document text
- https://mezikemopirexat.weebly.com/uploads/1/3/5/9/135993778/nisubuzafo-tatufus-gamanudaletajo.pdfIn PDF document text
- https://sulomotosepotu.weebly.com/uploads/1/3/4/7/134744650/tamonovut.pdfIn PDF document text
- https://nakenofol.weebly.com/uploads/1/3/0/8/130814118/8201863abd6728d.pdfIn PDF document text
- https://sesumevikenaful.weebly.com/uploads/1/3/5/3/135346106/ridavegabexe-sabasolilutida.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- https://uploads.strikinglycdn.com/files/d267f62c-9986-4381-adfa-212adb698345/how_to_set_up_element_smart_tv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b3e5d7ed-98b3-4124-8fd2-4304be7554cc/sas_survival_guide_amazon_uk.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/095794b8-7708-4185-9633-7d9e1fdb5b33/megisodo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fd327a1e-f639-4fdd-a9c2-2659176e922c/speed_queen_washing_machine_for_sale_johannesburg.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b186ca0b-f774-4d68-8a67-5ea26d4e1d37/39804062252.pdfIn PDF document text
- https://s3.amazonaws.com/rawesaragegugar/2005_jeep_grand_cherokee_headlight_switch_replacement.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ce662efe-b238-4e2e-ab2e-1703e5ee3ade/maths_textbook_class_12_ncert.pdfIn PDF document text
- https://s3.amazonaws.com/povelenavuviw/bejeweled_3_para_android_descargar.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cc602f61-3bc7-4227-98cd-184d5bf21f72/how_to_connect_presonus_audiobox_to_garageband.pdfIn PDF document text
- https://s3.amazonaws.com/vikukinumet/cannibal_holocaust_theme_sheet_music.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/db45cd11-23fa-429a-be7e-b253077a3ad5/trolls_pop_up_game_instructions.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a202598a-b721-4877-acc8-85dff0ebfe4a/74069445091.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
- http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0002d0e6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2D0E6	5204 bytes
SHA-256: `a72b32b8e3787a5ba0454b7a672ae68e29c1e6251525fd56cc664e26c82e42d5`
`font_01_sfnt_off0002e2a6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2E2A6	3740 bytes
SHA-256: `eb903a4bcabb0673128613fc2c6a3b3be6b6be0204d11159aa2f590e1d82ee93`
`font_02_sfnt_off0002ee1f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2EE1F	15804 bytes
SHA-256: `75f274a8d7dceca67acf9e29a7921b473ae29d2304eb406cdda8bd0a869da001`
`font_03_sfnt_off00031c77.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x31C77	6672 bytes
SHA-256: `51430477e878b87e3de42a2819d7e3aad2f5ae8ed60fef95f53c3dcea994401c`

Open this report in the interactive analyzer, or submit your own file for analysis.