PDF malware analysis — malicious · cfe43358f577e2fe

MALICIOUS

PDF

65.2 KB Created: 2021-02-13 07:50:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 79fa58779c6e2f13d5659d2e9717a3f0 SHA-1: 98a60cda749f5700e728d4e5ad29f78edec5c0e0 SHA-256: cfe43358f577e2fe4e25ec4e0326e07b8d5404e8e9ba4853e76d777f54f64c03

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'leonvi.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'Los numeros ordinales worksheet', indicating a social engineering attempt to trick the user into interacting with the malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://leonvi.ru/wix?keyword=los+numeros+ordinales+worksheet
- http://center-san.ru/followers_on_instagram_not_in_orderkqd3f.pdf
- https://kutufexefe.weebly.com/uploads/1/3/4/6/134695169/museximipes.pdf
- http://topstop.site/escuela_biblica_de_vacaciones_2018a1cl5.pdf
- http://sluzhba1.net/the_fool_on_the_hill_sheet_music03bv4.pdf
- https://cdn.sqhk.co/wazafanez/e5iaicF/munuvunukaga.pdf
- http://cuzinfo.ru/88675037686nu7gu.pdf
- https://cdn.sqhk.co/kebokeregim/ijjcjgO/stick_shadow_war_fight_vip.pdf
- https://manabaxijex.weebly.com/uploads/1/3/4/6/134626004/genimamizukedaxavan.pdf
- https://tegidaweriwasul.weebly.com/uploads/1/3/1/4/131483440/e717d69d2b2d50.pdf
- http://wowmarket.info/name_game_song_lyrics_american_horror_storylsk1a.pdf
- https://cdn.sqhk.co/sinemajud/ghQTjjR/zombie_roadkill_game_hack_version_download.pdf
- https://bukodagunotul.weebly.com/uploads/1/3/4/0/134012399/mowomokasopilitakisa.pdf
- http://fakts.design/85332689688hu3mp.pdf
- https://xabesokexiba.weebly.com/uploads/1/3/4/3/134327988/tumov.pdf
- https://cdn.sqhk.co/zimuteraf/ujdjbXC/one_gold_bar_cost.pdf
- https://vudelugofede.weebly.com/uploads/1/3/4/3/134383428/23b24b2d8e.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/belopudevuzuza/93101572644.pdf
- https://s3.amazonaws.com/tubukeganuji/50558577972.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000bc55.bin` `a49a36a9ff7bb8d4ec4d13483b3b469cf28d44e44fc4617d48951a99c8742ea8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBC55	5160 bytes
`font_01_sfnt_off0000cdc5.bin` `5b478c43827b525810fda3b8ebb3873450973e62f7f9d8771ca1a4232346b4ae`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCDC5	12980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.