PDF malware analysis — malicious · c196e0fa507338cd

MALICIOUS

PDF

76.7 KB Created: 2021-04-21 23:07:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 97228fe13c972cdddacd8c6f1eccad73 SHA-1: 958d0f364fa28b5c613dc7e0898d5670112f6f49 SHA-256: c196e0fa507338cdee93c45ad3877b08ad276d01895b2da1d600654f2738bd8a

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also strongly indicated maliciousness. The document body, though heavily obfuscated, appears to reference a Garmin device, suggesting a lure to trick users into visiting the malicious URL for phishing or to download further malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kuzutuzo.ru/strik?utm_term=garmin+drivesmart+55+lmt-d+eu
- https://cdn.sqhk.co/sowanigog/IEjiogj/36600590354.pdf
- https://cdn-cms.f-static.net/uploads/4428039/normal_603a5d722b5a6.pdf
- http://tamodemuror.getenjoyment.net/the_anarchist_s_design_book.pdf
- https://cdn.sqhk.co/koditisalupe/X9iciaV/sarasurorekamuvixifaxe.pdf
- http://jabilevij.mypressonline.com/sofekutowevezuzez.pdf
- http://sizuxofutitarax.mypressonline.com/62646677312.pdf
- http://mufutekuson.getenjoyment.net/how_do_you_reprogram_a_white_rodgers_thermostat.pdf
- https://cdn.sqhk.co/tedalome/ek8VrCf/strike_fighters_project_1_mods.pdf
- http://rexonina.medianewsonline.com/msdart_windows_10_iso.pdf
- https://cdn-cms.f-static.net/uploads/4495271/normal_6026c05a6b72a.pdf
- https://cdn.sqhk.co/xoguvamev/chCMLhi/word_categorization_worksheets.pdf
- https://cdn.sqhk.co/xebibugekux/ghhbcgh/flagstone_patio_pavers_for_sale.pdf
- https://cdn.sqhk.co/mogudekusab/cRheagj/44819896900.pdf
- https://cdn.sqhk.co/jijatidos/bHJ9zjf/butterfly_stickers_3d.pdf
- http://takipibimaxubov.sportsontheweb.net/pufisifasujemoxufituloj.pdf
- http://zutolewe.mywebcommunity.org/qaseeda_ahmadiyya_download.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://vujadexofon.atwebpages.com/zujaledetenikuzojokirasim.pdf
- http://xizokenimufewom.atwebpages.com/gusikisorijuguxaxanazox.pdf
- http://fataragoreb.myartsonline.com/abc_chart_download.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eba5.bin` `2fdb1095412ff8b8600e458cb41872e36eb3677f0c5876269f315758c776642f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEBA5	5216 bytes
`font_01_sfnt_off0000fd5b.bin` `3c15f7b3a7daadc74cd0a032ab4ba19dfa68982797f75c9286537b66b0fe427f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD5B	13036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.