PDF malware analysis — malicious · c26a3bfb379a5736

MALICIOUS

PDF

75.2 KB Created: 2021-03-28 09:55:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: ce2765cb0cb7bfe90dd160a4598ae415 SHA-1: 1a38b07f83485a2f017621bb7c1fba8216bae439 SHA-256: c26a3bfb379a573653c1a7aa83dfe35df4e2f9e5bfab208d525272e2afea600d

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to a suspicious domain, which is likely used to host a malicious payload or phishing content. The document body, though heavily obfuscated, suggests a lure related to a 'Canzoniere chitarra facile pdf', which is likely a pretext to drive users to the malicious URL.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jumiwimov.ru/award?keyword=canzoniere+chitarra+facile+pdf
- http://fonivoguko.medianewsonline.com/tabla_de_verbos_auxiliares_en_ingles.pdf
- http://jirusulixozome.scienceontheweb.net/4688196421.pdf
- https://cdn-cms.f-static.net/uploads/4411717/normal_5fd330ea55d7f.pdf
- https://fovivijidilel.weebly.com/uploads/1/3/4/8/134888041/5434915.pdf
- http://tokio-2020.fun/wosomop93f81.pdf
- http://instapodarok365.site/pokemon_red_guide_download3o73a.pdf
- https://cdn-cms.f-static.net/uploads/4373782/normal_60343d3e5439b.pdf
- http://choosenews.space/fekukalojukagutewape53rh.pdf
- https://gopelema.weebly.com/uploads/1/3/4/3/134314553/3073315.pdf
- https://static.s123-cdn-static.com/uploads/4462993/normal_5fdeaf77ce2af.pdf
- https://simokodopegaliw.weebly.com/uploads/1/3/0/7/130776428/tenem.pdf
- https://vedatirujoxe.weebly.com/uploads/1/3/1/6/131606280/resepazazet.pdf
- http://kitukotobov.medianewsonline.com/kogakedurejuzabunadiv.pdf
- https://cdn-cms.f-static.net/uploads/4386618/normal_6039a73bd29f8.pdf
- https://jewaxesototipa.weebly.com/uploads/1/3/5/3/135326518/fowizoreziv.pdf
- http://tediwaxivuj.sportsontheweb.net/gufawikati.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/kukazowox/buffalo_nfiniti_router_manual.pdf
- https://s3.amazonaws.com/vexeliku/5268690831.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e6bb.bin` `f4050f8a68843074de12d13507cf28e08533766c6ed7ba77ab9ff03b38ef4610`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE6BB	5020 bytes
`font_01_sfnt_off0000f7d4.bin` `fbc05f0d6b07354937a22166643d4a6027b43429c5573914e4a7c438350a62da`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF7D4	11672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.