PDF malware analysis — malicious · a33d8bf4a93c619e

MALICIOUS

PDF

84.8 KB Created: 2021-07-22 11:42:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: 65cb60fa56c5d08805490938766c0da4 SHA-1: cb36b9060453a5c7cb4577177cf3d607166e85b5 SHA-256: a33d8bf4a93c619ea950b24ea02e77d5909053455dce12b094dc0b1cc94031b7

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious. It contains embedded URLs, one of which points to a suspicious Google feedproxy address, suggesting a phishing or malware distribution attempt. The ClamAV detection further solidifies its malicious nature, likely as a phishing document.

Machine Learning

Nyx PDF Classifier malicious score 0.9991

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://feedproxy.google.com/~r/sq/ugae/~3/nCRFBnYrBHY/square?utm_term=720+excise+tax
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f6794f18f24d24f44d3151/1626765647969/acnh_new_villagers.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f307b9a047b636122115e6/1626539961642/compact_and_repair_database_in_access.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ee4b8e33d4654651be69ef/1626229646396/wobefivomuxi.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f56aa3a3156f43f34b1eb6/1626696355599/94344589435.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec7d1f0d838b6c850c324a/1626111263279/age_structure_diagram_declining_population.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8eb98b10b9b33fa9527ff/1625877400321/example_of_conclusion_in_research.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f5e32282ed071358c60c2d/1626727202244/free_business_partnership_agreement_template_south_africa.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f1e3f729b89860490c4a51/1626465271409/7086736429.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f45b118a396f1703a91cb7/1626626833642/subject_positions_discourse_analysis.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ecc64fb9c492708be7fc38/1626129999903/33167219396.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f18a1e5f8d8d13f71cd093/1626442270416/whats_the_difference_between_induction_and_conduction.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ee627f9b1e4d6a360f8880/1626235519141/best_offline_maps_android_2020.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f44448d9389f5e8096de55/1626621000101/jurudixopix.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60f917f93dc1753e7ba8d64c/1626937337746/36622915706.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f8e060bc27a573ccbf3e9d/1626923105035/79762303522.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f5ae9e940f8d032a899fbf/1626713758772/51663915946.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e932c3cc7c0864592772a2/1625895619210/the_fixer_read_online.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e91e25787dde1a90ade2af/1625890341621/pdfpen_for_ipad_review.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60edceb9537dfa20040307ba/1626197689179/2_seater_convertibles.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e769786f26a74a07f859e3/1625778553100/oxygen_concentrator_machine_on_rent.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60efda564063550b157ac9bf/1626331735072/is_electrical_conductivity_a_physical_property.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f49ddf1d350707422d1583/1626643935884/resorumafoburateloxebez.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e8cb36af17b116dc5e533c/1625869110841/pes_2020_ppsspp_file_iso.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e9ab.bin` `d0b1aa59fce1239a112048144699536f716e226a7ceba82e26ffa92b9313b7af`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE9AB	17128 bytes
`font_01_sfnt_off000116a3.bin` `592f08753afe473c59b0d458032c8214b9992ba237c1701046f06bd8cdcdfd94`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x116A3	10152 bytes
`font_02_sfnt_off00012da3.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12DA3	16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.