PDF malware analysis — malicious · c4d438ecec31226c

MALICIOUS

PDF

82.2 KB Created: 2021-07-12 22:37:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: a2b6a667570b98bed4d50b5302bca057 SHA-1: a4d3488059f6b96c4cb1ca1bd4a7bd50d16320d5 SHA-256: c4d438ecec31226c41e28faa8f992260806bbd36c29a6306abd073ef4eaf6d96

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is identified as malicious by ML classifiers and ClamAV, with heuristics indicating the presence of external URIs. Although the document body is heavily obfuscated and unreadable, the PDF structure and heuristic firings suggest it is designed to redirect users to external URLs. The primary IOC is the embedded URL, which is likely part of a phishing or malware distribution scheme.

Machine Learning

Nyx PDF Classifier malicious score 0.9906

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://feedproxy.google.com/~r/sq/ugae/~3/cEZ-xJcQpFE/square?utm_term=meaning+of+abord
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e818a897884458c9a41167/1625823400997/72844857356.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8f4812a6f785f5832666b/1625879681717/52980918417.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8d0bba15ec47e0818379c/1625870523748/most_popular_beer_in_the_world.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ec932a7dc7460dd09c1875/1626116906948/latin_words_with_z.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec7cd372e2584f24629b99/1626111187169/i_have_to_find_myself_quotes.pdf
- https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e767e7e055dd31fd065943/1625778152083/extraembryonic_mesoderm_is_derived_from.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8bb0ab009f83b0754acc9/1625864970310/will_be_considered.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e9332783ae0c490239b13a/1625895719905/mibidumes.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec7ffa40121f5668999386/1626111994284/12599608707.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dfad.bin` `eb190348942818f93546a4fb8b4b97b2ff7e61620f75c54dcfd3e460a8853028`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDFAD	16920 bytes
`font_01_sfnt_off00010c07.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10C07	16792 bytes
`font_02_sfnt_off0001241e.bin` `0bad073adb043c9eaa983c8ef73b46a3e2119e6d1bbbae3e65261d497f61d86d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1241E	10348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.