PDF malware analysis — malicious · b9a2b45058e1bc4c

MALICIOUS

PDF

126.7 KB Created: 2021-03-21 03:49:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 99feb841fd96d78234d7a39542a576a9 SHA-1: 22984caf42698a3f62d90f373438ffd6072d4beb SHA-256: b9a2b45058e1bc4c1d3f0c7ae67ab5cc1cf9d4628fdb987397ac0a1100d2b543

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI that mimics a search query for a service manual, likely as a lure to encourage downloads. ClamAV detection and ML classification strongly indicate malicious intent, classifying it as a phishing trojan. While no scripts were explicitly extracted, the presence of external URIs suggests a potential for second-stage payload delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://leonvi.ru/wix?keyword=yamaha+f300+service+manual+pdf
- https://cdn-cms.f-static.net/uploads/4416675/normal_601452edf2663.pdf
- https://cdn.sqhk.co/votojuxosaf/jctOijv/75786055819.pdf
- http://vopugixeroramox.medianewsonline.com/datud.pdf
- http://loveworld.club/pubogidixojaporwvinf.pdf
- https://cdn.sqhk.co/vatukaso/f3gdyhb/power_music_group_rx_revolution.pdf
- http://proflist-briansk.ru/vomiting_and_diarrhea_covid_19_symptomsqc1s2.pdf
- https://static.s123-cdn-static.com/uploads/4388178/normal_5fc83593ae630.pdf
- https://cdn.sqhk.co/nikapeke/Xgca6gc/36224729129.pdf
- http://italysummer.space/purified_water_ip_monographca5ed.pdf
- https://cdn.sqhk.co/daladovum/hkgdJha/angry_hanuman_hd_pic.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://zaduzos.myartsonline.com/sokosukiboxadarug.pdf
- https://01477de9-116b-42a6-a62c-54244336611e.filesusr.com/ugd/dea9e9_82a1e08ea6c444aaa76a02b7aeb2cb30.pdf?index=true
- https://3745348a-78a0-42d7-8ff4-af2b45bf5faf.filesusr.com/ugd/02631b_b68599d4ef1b4d12a39cc10f5c3c6ed7.pdf?index=true
- https://s3.amazonaws.com/tesotiwapax/buku_akuntansi_biaya.pdf
- https://d4078116-a2d5-466f-97e6-20d899f6ca30.filesusr.com/ugd/576447_4be4e50fce0f45b8a50b2df1fee8fd00.pdf?index=true
- https://s3.amazonaws.com/pukaridimupo/how_to_start_binary_trading.pdf
- https://6c892e0d-5736-4b4a-96a3-cd490fd1fe3d.filesusr.com/ugd/1407cd_febf0937c8b74dcea584edbef52a4750.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001b173.bin` `a3e71aa089a82c3ccdd7ee3c713d20216b3d506da37e6085d0ddd151e96be5a9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1B173	5720 bytes
`font_01_sfnt_off0001c4c5.bin` `49a1e0141294f740ad8e84fd1690a316fc8fa2a296bd4d30b86e4ff3e87ba345`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1C4C5	11772 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.