PDF malware analysis — malicious · cca1c46a7912a959

MALICIOUS

PDF

76.3 KB Created: 2021-03-26 01:15:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 34c026253836582e453a9d4959b35be6 SHA-1: 59739dac19ee51231f43ae4dd8a9b668ed6f7107 SHA-256: cca1c46a7912a9592e774ad36a7c1a1f7561c677e6a1990a8e0528f402d2046e

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that leads to a phishing page, as indicated by the 'Pdf.Phishing.Trojan' ClamAV detection and ML classifier flagging. The document body, though heavily obfuscated, suggests a lure related to 'Bollywood songs lyrics pdf'. The presence of an external URI points towards an attempt to redirect the user to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9977

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/award?keyword=bollywood+songs+lyrics+pdf
- https://cdn.sqhk.co/rixutixim/bvRvKia/76317631344.pdf
- https://cdn.sqhk.co/fiporalisu/jhTgjWI/dekuwe.pdf
- https://cdn.sqhk.co/pixazizaze/2lhiXAX/shadow_cloud_gaming_xbox_controller.pdf
- http://wusejopajaxus.22web.org/icar_exam_form.pdf
- https://cdn.sqhk.co/vopofuxo/hghjbDH/telegonakuniziduwofareg.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/jaloto/gepavobi.pdf
- https://s3.amazonaws.com/tuzamada/kuvebutijedako.pdf
- http://wigewedarigal.rf.gd/how_to_write_book_report.pdf
- https://s3.amazonaws.com/jitimesolagun/wifuk.pdf
- http://gizexagivet.rf.gd/35179682344.pdf
- https://s3.amazonaws.com/muxegeza/15480280467.pdf
- https://s3.amazonaws.com/rijaliwiguvex/carrying_noun_form.pdf
- https://s3.amazonaws.com/wujixus/41862248135.pdf
- https://s3.amazonaws.com/tixeligufokup/gijaxavabolala.pdf
- https://s3.amazonaws.com/gofiguj/memowukaponetufa.pdf
- http://vinodek.epizy.com/74296752710.pdf
- https://s3.amazonaws.com/pugomonapoxuxe/diversey_safety_data_sheets_uk.pdf
- https://s3.amazonaws.com/fixararololu/google_chrome_application_cannot_be_started.pdf
- https://s3.amazonaws.com/povodijirig/38269920690.pdf
- http://nanixalo.rf.gd/tiwomoravitabavelan.pdf
- https://s3.amazonaws.com/jiwotarotavuz/bismarck_wows_guide.pdf
- http://jobisazukom.rf.gd/bibiliya_yacu_and_install.pdf
- https://s3.amazonaws.com/jadudusujuje/beviwolulilakunubepotogi.pdf
- http://godolefimew.epizy.com/the_cask_of_amontillado_summary.pdf
- http://sosodif.rf.gd/89498064149.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f2bf.bin` `79d549fe8255bc6ffaf02f81ca0345ec34b3736efcdd3bfe14abe8954e07eccf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF2BF	5356 bytes
`font_01_sfnt_off00010528.bin` `29a0dabb5c9739a9231441a3aea41d9ed6b5dbbebf69befee9a2fec3e7ec7478`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10528	10704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.