PDF malware analysis — malicious · a38cb1b7336c05fb

MALICIOUS

PDF

83.4 KB Created: 2021-07-13 17:43:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: 261e353bf0f495abeb53cc162451707d SHA-1: aa33ab346324939511d0938395f95289ddb52872 SHA-256: a38cb1b7336c05fb960f5f24cef8976c11198c252eebf6efc6b32ec999af2566

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to an external URL, which is a common tactic for phishing or directing users to download further malicious content. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of the malicious URL is a strong indicator of an attack.

Machine Learning

Nyx PDF Classifier malicious score 0.9438

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://inwebjor.ru/square?utm_term=jailbreak+ipod+touch+2g+4.2+1+greenpois0n+download
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e85b30dd097118f52f9dc3/1625840432825/butotubuvutenidepufafep.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ed2b16c2b47a6141a06070/1626155799030/33826947348.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ed88f4f77a3e4a90f5c1c0/1626179828646/diy_reeses_peanut_butter_cups.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e8ac68fa178c242f3bc4ee/1625861224834/gajogororufodekegup.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec90cd1951226b8b8bd0bb/1626116301742/kuxis.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ed896693721672204c5089/1626179942838/wigozolivaxakes.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec7b103a853d606aeb8ab8/1626110736817/meaning_of_abortion.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e8d3c5a15ec47e0818572a/1625871301244/73323891044.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d8e1.bin` `3613e5f42ad0ef6c79de4cd32d7b0a4e29d4161bbd6dbc316650aacbe4175d5c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD8E1	20148 bytes
`font_01_sfnt_off00010b77.bin` `ed20573b2a0ffdbd429983d30c704d7e1fcdb90a80833261bea9d6fd198c86db`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10B77	11640 bytes
`font_02_sfnt_off000126d9.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x126D9	16792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.