PDF malware analysis — malicious · c96fe713668c6885

MALICIOUS

PDF

83.7 KB Created: 2021-03-21 09:36:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 1c3cc0ca8d472d37c5b3247d13539efb SHA-1: ba5f259a271a3f96351320165437f6b0c6b40574 SHA-256: c96fe713668c6885a9d6acf4323a20c3cc59b2ba6b83326cd4a8e7e4edbbd2b2

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to a suspicious domain, vilenefex.ru, which is likely used to host a phishing page or a second-stage payload. The document body, though heavily obfuscated, suggests a lure related to educational content ('Ken burns dust bowl worksheet'). The presence of multiple suspicious URLs further supports a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/wix?keyword=ken+burns+dust+bowl+worksheet
- http://bevasesebesed.iblogger.org/cgp_ks3_maths_answers_online.pdf
- http://hermidkovo.info/zentangle_art_ideasuhlkn.pdf
- http://shoppermarket.online/apache_web_server_for_windows_8wcfy5.pdf
- https://cdn-cms.f-static.net/uploads/4391907/normal_602ebf2b2baf4.pdf
- https://cdn-cms.f-static.net/uploads/4492294/normal_603cc8aaa9157.pdf
- https://cdn-cms.f-static.net/uploads/4376127/normal_60372eb980ec8.pdf
- http://igcopyrightverify.com/steam_turbine_isentropic_efficiency_calculatornomgo.pdf
- http://huseyincanx.com/votodezononifozapewux3yx5.pdf
- https://cdn-cms.f-static.net/uploads/4499285/normal_5fea01bf04d87.pdf
- http://joteruzawareba.iblogger.org/messenger_pc_facebook.pdf
- https://cdn-cms.f-static.net/uploads/4420612/normal_6014ce4e040f5.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/jepinebawo/65406193107.pdf
- http://siwixipupiluzu.rf.gd/lonipabekuniliw.pdf
- https://uploads.strikinglycdn.com/files/dcbb8094-9c30-4f2f-aa23-d91480c990e9/45120707867.pdf
- https://uploads.strikinglycdn.com/files/20821816-d155-4726-b3b4-dc5210e0cb53/96438248626.pdf
- http://nadinuvuxogi.epizy.com/2424397062.pdf
- https://s3.amazonaws.com/semuxemakaw/60336172531.pdf
- https://s3.amazonaws.com/sazomo/nanostation_m2_factory_reset_button.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010b54.bin` `0252c90bc1d7da2ab1f1eba07fd02e987ff7828ea41feda5d0c277d0a30683fd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10B54	4968 bytes
`font_01_sfnt_off00011c3f.bin` `4121615a5ed1604c2787cbacf87439eb4f4eb0e2fb0ed938c47bf081a5894ffa`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11C3F	11044 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.