PDF malware analysis — malicious · bb9dc67896efcf69

MALICIOUS

PDF

75.1 KB Created: 2021-03-14 08:54:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: eb21c0a478c50259683ebb58c98a8c39 SHA-1: dc7c01849e2458b1a45c9e3532a8b4b3e3cd9590 SHA-256: bb9dc67896efcf69223cf9c698d9107588800599e33b22fbb716efb9217a3e9d

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. An external URI, 'https://zajinet.ru/wix?keyword=eastway+middle+school', is embedded within the PDF, suggesting a lure to a malicious website. The document body contains metadata related to its creation, but no explicit instructions or further context for the malicious activity.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://zajinet.ru/wix?keyword=eastway+middle+school
- http://duwosolutanuz.mypressonline.com/what_is_an_isekai_manga.pdf
- https://cdn-cms.f-static.net/uploads/4413564/normal_6027cee77ae8c.pdf
- http://xuxetosufuzo.getenjoyment.net/carry_on_my_wayward_son_series_finale.pdf
- http://nenotuwafuxigot.22web.org/video_camera_angles.pdf
- https://cdn.sqhk.co/zidexamuwela/WidMgiB/gekekijasisuponawurun.pdf
- https://static.s123-cdn-static.com/uploads/4422628/normal_5fec2f1b8768a.pdf
- http://moderivapotilos.22web.org/28607615008.pdf
- http://vebilodugisugod.iblogger.org/50926637726.pdf
- https://static.s123-cdn-static.com/uploads/4407066/normal_5fcb504eb9708.pdf
- http://nobipobis.22web.org/16931838713.pdf
- https://cdn.sqhk.co/fewoxenovof/rlhbU8j/farming_simulator_usa_2_apk_download.pdf
- http://larediwavokib.iblogger.org/61020300745.pdf
- https://cdn.sqhk.co/sapugelezuf/fQhchfZ/pisijagudigefakuxifevun.pdf
- https://cdn-cms.f-static.net/uploads/4488822/normal_6041dbf9a9ac6.pdf
- https://cdn.sqhk.co/folamudoj/jQibZBX/59261961805.pdf
- http://lixodamevurobar.mygamesonline.org/dugolimuluxube.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://nepunefetonub.epizy.com/mugafamimogo.pdf
- http://mijekobafenado.rf.gd/the_scarlet_pimpernel_synopsis.pdf
- http://dorolafif.rf.gd/nitasinowinalodov.pdf
- http://ramivigemotaf.epizy.com/34787449480.pdf
- http://firotiz.epizy.com/wirarunesozovinafekazor.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e9aa.bin` `9a34502f6e77838cccb93804ad6c853df1f13b495b3083995cf6390754007362`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE9AA	5232 bytes
`font_01_sfnt_off0000fb67.bin` `f65363d2b7de6308e9426212cbb765256b1f3a7ce6f2d1957b3c3127cc343a19`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFB67	10540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.