PDF malware analysis — malicious · c1dc5d3cac5bce24

MALICIOUS

PDF

103.0 KB Created: 2021-07-23 04:22:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: b77931bd74f452a57a9129b909ed1b80 SHA-1: b2f01819c7e6b8a3f258e9f00a0104eec8f0d322 SHA-256: c1dc5d3cac5bce242b3029a0ac3c90976b204b9e1e474315b5f738e4f6b432dc

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains embedded URLs that likely lead to malicious content or further infection vectors. The presence of PDF_URI and EMBEDDED_URL heuristics suggests the document is designed to redirect users to external resources.

Machine Learning

Nyx PDF Classifier malicious score 0.9636

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://feedproxy.google.com/~r/sq/ugae/~3/iCUEKX862tE/square?utm_term=the+solution+of+a+linear+equation+in+two+variables+is
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e8fd54e6bd1231e6067969/1625881940281/console_commands_the_forest_ps4.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60f1687be7c78223958b62df/1626433659172/zevomodat.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f659acf3a396036e36a001/1626757548305/17902304817.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec81a182b4c978cf41706c/1626112417960/set_a_timer_for_47_minutes.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ee55fa1cf0e6777f3022fc/1626232314524/how_to_change_windows_password_without_old_password.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60f1708a15846f0d14edeffc/1626435723553/tuxededu.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60edc22f9779423221dcd55a/1626194479362/opm_operating_manual.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f368b1a8f65e35b6dabfb3/1626564786066/16278237549.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ee5773f6c772366d2fc4c9/1626232691937/netisutiwosipalugomup.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60ec7b5d67baa26076baf184/1626110814004/my_left_ball_hurts.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f6114cea390a02402c8e59/1626739020241/escape_from_intimacy.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f93d413f3fc43c4a275d23/1626946882167/each_angle_of_a_rectangle_is_a_right_angle.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee011782b49873592db827/1626210583514/initialize_only_using_the_camcorder_canon.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60e89f663cf73c101f1fc9bd/1625857894323/44746149668.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee277e02e0767984f1f62d/1626220414790/jofowonixopunu.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ec790aad4a1a22a3e65c21/1626110219041/zesekijewexala.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60f2627726c2747482d63367/1626497655844/tell_me_about_a_time_you_had_to_multitask.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e826c87be683581ce576a5/1625827016535/types_of_constructors.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ec77f63a853d606aeb3b48/1626109942794/difference_between_automated_and_manual_system.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60f74a3ea13b673dad34f2b3/1626819134319/if_the_displacement_time_graph_of_a_particle_is_parallel_to_time_axis.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f13b67b238236d2333bf22/1626422119907/loved_you_first_1d.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60f80e7af603c47074eb87e0/1626869370257/canon_powershot_sx130_is_manual.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60f10907d1d8e65aae855e6e/1626409223091/riven_from_league_of_legends.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60e937fd2a6f785f58351c6a/1625896957365/insert_pages_to_word.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60f62f1c132d7d1ce060e8ea/1626746652154/64744984115.pdf
- https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ee67481f51426150cfa434/1626236744446/pray_for_the_government_bible_verse.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00011832.bin` `5534d0fa64d4ef7a6a2dbd8ff74f71eb7f2e0df27b4dac432a21bf93862bde39`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11832	10812 bytes
`font_01_sfnt_off00013128.bin` `b005ce3d0a72473ace01fc7024938dddd31d48f93859032e202b2d3782d0654b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13128	17668 bytes
`font_02_sfnt_off00015ffa.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x15FFA	16792 bytes
`font_03_sfnt_off0001780b.bin` `325c5f5cda05429ae92d15c23118ca1b8712e485108c584e1e30b0ff615913b7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1780B	16084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.