PDF malware analysis — malicious · a19f5561f19eb562

MALICIOUS

PDF

76.2 KB Created: 2021-02-16 05:08:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 682f4eb8aefc17e9985e1be6ca34d4cf SHA-1: 9cd4ed992c5497ed3591f091324de60befbca4fa SHA-256: a19f5561f19eb5629adf8430b2be11100588c4677d28a557469011c0ea52b226

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely used to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a theme that could be used as a lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/wix?keyword=theme+of+chapter+4+into+the+wild
- http://soinjaga.ru/voxofatow2zo.pdf
- http://itawegan.space/mumoxinowugifoki03s4.pdf
- https://piroveda.weebly.com/uploads/1/3/2/7/132740505/8638819.pdf
- http://lewuvajenajen.iblogger.org/incredible_quotes_to_guide_your_life.pdf
- http://baxagaxisatipa.22web.org/rap_beat_maker_app.pdf
- http://nulonelam.66ghz.com/karobuwolemenubiw.pdf
- https://lubikumak.weebly.com/uploads/1/3/1/4/131453733/352c2989f81a.pdf
- https://zufuleruzu.weebly.com/uploads/1/3/1/6/131637307/zavado.pdf
- http://edevletorg.com/prueba_de_matematicas_octavo_basico3wov6.pdf
- http://chestlune.online/monster_energy_supercross_game_3_split_screen73nn3.pdf
- https://nasuzezigoma.weebly.com/uploads/1/3/4/5/134587751/0e09903b13.pdf
- http://verifedform.com/grey_worldwide_sea_sdn_bhd8kd9p.pdf
- http://zugunef.22web.org/atm_online_form_sbi.pdf
- http://teasmall.space/liz_in_september_online_full_movie0uku3.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://wevaxelim.rf.gd/2908964924.pdf
- http://gijifosunusu.epizy.com/acronis_disk_director_crack_free.pdf
- http://lakugarim.rf.gd/the_latest_call_of_duty_game_for_ps4.pdf
- http://kasanuvuwa.epizy.com/67454644570.pdf
- http://lerezivopo.rf.gd/media_clip_pro_video_er.pdf
- http://katibabiziv.epizy.com/fm_global_product_approval_guide.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f08a.bin` `ae97773380ee2f3f01c282eb63cb50e07346d87fbdbf0a3b40fc038fc829f41c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF08A	5344 bytes
`font_01_sfnt_off000102a3.bin` `3a1842ab354da0028f728bd2129bad7042bd62c3a42ea879006f384f8ebe74af`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x102A3	9588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.