PDF malware analysis — malicious · a4c04fccff588fef

MALICIOUS

PDF

67.5 KB Created: 2021-03-15 19:39:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: b64eb027d82577e483b07fe93cbdbe00 SHA-1: be82a2ef5b9bc41b2503f557254fb97550938056 SHA-256: a4c04fccff588fef7d4d74404c76054b5e907c04bc5970906f4ef8be08448f7a

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL, https://crophysi.ru/wix?keyword=elements+of+fiction+quizlet, is likely part of a phishing or credential harvesting scheme, disguised as a quizlet study guide. No scripts were extracted, but the PDF structure and embedded URI heuristic strongly suggest a phishing attack.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://crophysi.ru/wix?keyword=elements+of+fiction+quizlet
- http://fuxejezosajusop.22web.org/holy_bible_nasb.pdf
- http://wonozudobitisog.scienceontheweb.net/strength_of_material_solved_problems_4th_edition.pdf
- http://pewujok.mypressonline.com/how_to_set_time_on_a_lorell_radio_controlled_clock.pdf
- http://xukosususif.medianewsonline.com/komepedovuzejizujulubosi.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/bejexe/ecosystem_practice_worksheet.pdf
- http://zabukek.rf.gd/algebraic_fractions_worksheets_tes.pdf
- https://s3.amazonaws.com/latufenaw/gijefazijifumewona.pdf
- http://bejanifezilo.atwebpages.com/academic_vocabulary_in_use_key.pdf
- https://s3.amazonaws.com/jijumupade/44669062709.pdf
- http://bejumajiluwod.rf.gd/37606481353.pdf
- https://s3.amazonaws.com/bubisifapagefe/10833693583.pdf
- http://suxopubovokok.epizy.com/41192576419.pdf
- http://niwuzij.rf.gd/flame_broiler_menu.pdf
- https://s3.amazonaws.com/patilawasu/stackable_washer_and_dryer_reviews_consumer_reports.pdf
- https://s3.amazonaws.com/rotowan/12755248909.pdf
- http://zapulozamatuwe.epizy.com/mamas_and_papas_cot_fitted_sheets.pdf
- http://nalosig.rf.gd/mozilla_firefox_terbaru_offline_installer.pdf
- https://s3.amazonaws.com/gimufesajo/android_adb_exe_device_not_found.pdf
- http://tutizesedu.epizy.com/43012666767.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cdca.bin` `c04448aa787dfcdd06d4d23ee0d71b051b30bf94513bb6b3317d83726468b70d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCDCA	4852 bytes
`font_01_sfnt_off0000de50.bin` `b3a706788c0a1b0876dfd6d1c3fdbcb44a240bc98c73af91e64d994f46096a0c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDE50	10076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.