PDF malware analysis — malicious · c5620244598d816c

MALICIOUS

PDF

68.7 KB Created: 2021-03-21 05:28:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 2d68cecca24c4d53fc562501b8299a2a SHA-1: 16a2e55568e09e8759826cf1d04b9746b362c619 SHA-256: c5620244598d816c32f6845c3b15340aa82e5f7f3376f77539e1aeb923588b41

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to deliver a malicious payload or redirect to a phishing page. The document body, though heavily obfuscated, contains text related to movie streaming, suggesting a lure to entice users to click the malicious link.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://lozipotod.ru/wix?keyword=at%25C3%25A9+o+%25C3%25BAltimo+homem+filme+completo+e+dublado+online
- http://salopkisa.website/906130461336u7ig.pdf
- http://puvinizozibejir.mygamesonline.org/fidunutafejagedozik.pdf
- https://cdn-cms.f-static.net/uploads/4497344/normal_601e92607d8a9.pdf
- http://xupulakikovuxo.mypressonline.com/xipepe.pdf
- http://rezubodojel.medianewsonline.com/the_cambridge_dictionary_of_christian_theology.pdf
- https://cdn.sqhk.co/vixukose/hegegia/comic_stars_fighting_games_lol.pdf
- https://static.s123-cdn-static.com/uploads/4445557/normal_5fcd1c2d6c390.pdf
- http://fruit-italy.space/fegerubedonf5n8.pdf
- https://pedumukelogo.weebly.com/uploads/1/3/0/9/130969284/7206953.pdf
- https://cdn.sqhk.co/silijebutu/jbibAhp/download_game_crazy_taxi_mod_apk_for_android.pdf
- https://cdn.sqhk.co/lelogusobade/LSLihhf/lekebaxonuvadinim.pdf
- https://rujivedudupuvi.weebly.com/uploads/1/3/6/0/136051492/sixidipovuwotex-fuzikupire-kijusa.pdf
- https://cdn.sqhk.co/futevanu/gdugggh/frag_pro_shooter_tier_list.pdf
- https://jaketomerinojox.weebly.com/uploads/1/3/4/1/134109184/1d021632fc59e1.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/jusagi/org_chart_template_html.pdf
- https://s3.amazonaws.com/najubu/image_uri_to_base64_android.pdf
- https://s3.amazonaws.com/tevomenil/chelsea_fixtures_2018_19.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ca6a.bin` `b8de9b7f995bd46b4cc92ae239400b42b74b373b4f7e004cd200519d6137ca87`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCA6A	5508 bytes
`font_01_sfnt_off0000dc80.bin` `50491955aea73b22d25c8e83083f8ef7a7139f8072891b505fa39d0de5ff9ab8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDC80	12436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.