PDF malware analysis — malicious · b588dfd7e814dc0e

MALICIOUS

PDF

94.6 KB Created: 2021-02-25 09:16:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: afa5538256b19fa03af1f7a17d1c7339 SHA-1: ac6b2c23502a122c12dc5c7bd4134c03651fbbf9 SHA-256: b588dfd7e814dc0ee6e485944b8d44d896ff9872368095320885d0a2d240a6ed

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing site or download further malware. The document body, though heavily obfuscated, suggests a lure related to COVID-19 testing requirements, aligning with common phishing tactics.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/wb?keyword=can%20employers%20require%20covid%20testing
- https://jewakazakiven.weebly.com/uploads/1/3/1/4/131437085/2982669.pdf
- https://nimopiwezu.weebly.com/uploads/1/3/4/7/134700470/5321687.pdf
- https://sudororurupe.weebly.com/uploads/1/3/4/6/134602833/bugupixelasogat_lawejupipovitub_bepivaj_rokawu.pdf
- https://sitakubijilu.weebly.com/uploads/1/3/0/7/130776110/4048756.pdf
- https://cdn-cms.f-static.net/uploads/4486742/normal_603151020efd7.pdf
- https://ziripovamenof.weebly.com/uploads/1/3/4/6/134647136/8b4a80.pdf
- https://static.s123-cdn-static.com/uploads/4459794/normal_5fe5d8b8f3b26.pdf
- https://fimiximokizo.weebly.com/uploads/1/3/1/3/131384127/9398406.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/sinamozagemoger/veroxaregut.pdf
- https://s3.amazonaws.com/tufujifinobiro/fraction_word_problems_worksheets_high_school.pdf
- https://s3.amazonaws.com/nigimul/marvel_ultimate_alliance_ps4_modok_answers.pdf
- https://s3.amazonaws.com/xijuxosisomuna/maradona_new_malayalam_movie.pdf
- http://selaxarizipa.rf.gd/answer_2018_apk.pdf
- https://s3.amazonaws.com/xamibudasagas/98359629753.pdf
- https://s3.amazonaws.com/mokixetat/gavarenekujoxunumijej.pdf
- https://s3.amazonaws.com/lixuduwonifa/landscape_design_tool_free.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001356b.bin` `ca22490c16bd351d6b88c5326a34d11cd8e38c0ef4ef3d9ef0fc8e8a4899f38c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1356B	5584 bytes
`font_01_sfnt_off00014855.bin` `ecac2b275c4d1d5d0ee455b66f7ad368ff9305a9efeeffd9665145073456a58d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14855	10812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.