PDF malware analysis — malicious · c59830ec2e6b16e9

MALICIOUS

PDF

78.7 KB Created: 2021-04-01 16:21:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 3fbe544a093a5158f0405c72df526ad1 SHA-1: d6fb5a562f4163c177b6c766262caa9437dcd4be SHA-256: c59830ec2e6b16e97de26372cbb29fec6d01d352c2cc9cfa729c35331184252c

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL designed to trick the user into visiting a malicious website. The ML classifier and ClamAV detection strongly indicate malicious intent. The embedded URL, https://mezovuduw.ru/aws?utm_term=le+petit+nicolas+characters+movie, is the primary indicator of this phishing attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mezovuduw.ru/aws?utm_term=le+petit+nicolas+characters+movie
- http://autolombardpro.ru/55822929568p1o32.pdf
- http://microbladingcertificationdfw.org/78272498081d0x3o.pdf
- http://copyrightsupporthelpcenter.com/vigamilijebomotowolutiamn7q.pdf
- http://lezigovedavide.getenjoyment.net/pevukitapegoselekabetiluv.pdf
- http://vawabipoxe.sportsontheweb.net/carrageenan_properties.pdf
- http://copyrightreports.com/social_psychology_myers_13th_editionja34o.pdf
- http://gutowofobujibos.iblogger.org/que_es_taller_de_lectura.pdf
- http://usesalon.xyz/officejet_4630_black_inkvgah5.pdf
- http://tublitalia.fun/la_foule_paroles_accordsvjt8q.pdf
- http://iceteas.space/23300504968ypwxt.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://7fd9f749-07b0-48f8-ad51-68075edef824.filesusr.com/ugd/197648_7a9d1b711c6f4a3a940d891a9284e4d6.pdf?index=true
- http://zetomuroki.epizy.com/xogorivokevulufol.pdf
- https://e4da1597-3bb3-488b-9226-7c2c9e06e9ce.filesusr.com/ugd/db5d73_a9ceb5675efb420f8683fb95d378ae5a.pdf?index=true
- https://91953a53-6f32-4f2a-9b2e-0f954541ff31.filesusr.com/ugd/dad90e_0ee6476341fb4f82b3db48b4635a53ba.pdf?index=true
- https://1c019786-7048-4615-837a-ae53f087c4ae.filesusr.com/ugd/8b4172_dcbf80a4bcde49ddafe6936b3ddbd5b5.pdf?index=true
- http://xubudexev.epizy.com/java_8_numberformat_currency.pdf
- http://ruvedinaz.rf.gd/fantasy_football_cheat_sheet_espn.pdf
- https://abbf68a8-5b21-4996-91be-11266bd273ed.filesusr.com/ugd/9374a7_fe5ed6441a764484a140e98f510184ca.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f546.bin` `b32d69ec4dd0c822eb124fd83172a382da63d40aa45d6657834c3469fa2fb382`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF546	5172 bytes
`font_01_sfnt_off000106bd.bin` `fe219fc398a8d8515b1cdef42808b7132aed803fafc58a7d5d8cdfb0b42f71f6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x106BD	11008 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.