PDF malware analysis — malicious · be9d70ae9886dc68

MALICIOUS

PDF

82.6 KB Created: 2021-03-01 08:55:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 588d1ef78fc2956d27c45bf814876217 SHA-1: 16da3ab9efd04986b411ddc313e278dc28107084 SHA-256: be9d70ae9886dc68b2d6d8354e9b5ce973225d920aac825f293fa56b52450a93

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an embedded URI pointing to a suspicious domain, which is a common tactic for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were extracted, the presence of a malicious URL suggests the document is designed to redirect the user to a harmful site, likely for credential harvesting or further malware deployment.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kuzutuzo.ru/aws?utm_term=they+say+i+say+chapter+5+summary
- https://cdn.sqhk.co/kekelivig/ZjghixH/spider_rope_hero_stickman_crime_gangster_2019.pdf
- http://befipekawuzader.iblogger.org/bleacher_report_aew_buy_in.pdf
- http://fogozuvonuw.66ghz.com/onomatopoeia_worksheets_with_answers.pdf
- https://cdn.sqhk.co/xolofiwano/ghZicns/air_combat_racing.pdf
- https://cdn.sqhk.co/lubometusoz/ioQhfp5/kiko_del_chavo_del_8_murio_2017.pdf
- http://bestpriceforukraine.xyz/rowimqth8a.pdf
- http://teaapple.space/geometric_patterns_worksheets_5th_gradedfpqb.pdf
- https://cdn-cms.f-static.net/uploads/4485711/normal_6024619de5d34.pdf
- https://cdn.sqhk.co/vipujitebiki/jivhfif/sasibujuruxuja.pdf
- https://cdn.sqhk.co/nupasoxure/6SatdT2/gipusuv.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/nademopor/surah_al_kahfi_ayat_11-_20.pdf
- https://s3.amazonaws.com/batoragubukepo/backpacking_new_zealand_travel_guide.pdf
- http://fixelelediv.epizy.com/binutamiwimoluden.pdf
- http://kumobeba.epizy.com/40661829212.pdf
- http://gukuwet.epizy.com/7857134859.pdf
- https://s3.amazonaws.com/bubeto/87586009263.pdf
- http://kofuzedu.epizy.com/firumonaxisiladaloxiwo.pdf
- https://s3.amazonaws.com/sesafefanulokam/ledger_account_format.pdf
- http://vavijiguzedimeg.epizy.com/28696653256.pdf
- http://desibevazivoxan.rf.gd/81304192757.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001019c.bin` `1ee9e71549203d9416c293cc462f7f1008d67a43aac9ad5d68a3277be30d525c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1019C	5316 bytes
`font_01_sfnt_off00011393.bin` `b14dfa4c10c493b902be173f248fea8d9897303675aa793cc65ae782378f2afd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11393	12684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.