PDF malware analysis — malicious · d64726e0bed0be49

MALICIOUS

PDF

68.1 KB Created: 2021-03-15 16:20:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 5c0901700b7bc0536d1aaf4eda2f8942 SHA-1: e9fbf412f12c2b95986c46133aa1f372390f196e SHA-256: d64726e0bed0be496e2d02a66eb3b384d708a8f6e370d484a07c6d77f927acdc

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL that leads to a suspicious domain, likely intended to host a malicious payload or phishing page. The document body, though heavily obfuscated, suggests a lure related to educational materials.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/strik?utm_term=free+printable+fill+in+the+blank+hundreds+chart
- http://mojoliziriba.22web.org/firefox_browser_for_windows_10_free.pdf
- http://koduxipib.iblogger.org/sutinixutamalu.pdf
- http://vuxiparami.22web.org/accidents_reported_today_in_palmdale_ca.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/wefemabeni/cellulose_insulation_material_safety_data_sheet.pdf
- https://s3.amazonaws.com/mukut/23592745555.pdf
- https://s3.amazonaws.com/tevigotu/netawemavunurenozona.pdf
- https://s3.amazonaws.com/numegubowalonan/lewerefo.pdf
- http://mobosefevexaxep.rf.gd/apache_ignite_transaction_performance.pdf
- https://s3.amazonaws.com/sepovutapakogaf/fuvoj.pdf
- http://dixolasafu.epizy.com/vibuvufazigitewalixakevol.pdf
- https://s3.amazonaws.com/vezumobigodub/nepoboz.pdf
- http://xedotowatanulew.rf.gd/metal_gear_solid_4_big_boss_voice_actor.pdf
- https://uploads.strikinglycdn.com/files/3cb1bd70-9d78-48b0-8ff5-795c8148828f/how_much_do_swat_make_in_texas.pdf
- https://uploads.strikinglycdn.com/files/cf33420d-7aea-46fe-82c9-542c64518815/fasebodegabu.pdf
- http://sofijorube.rf.gd/53972359360.pdf
- https://s3.amazonaws.com/wejuvono/the_ascent_of_money_documentary_download.pdf
- https://uploads.strikinglycdn.com/files/e4cc496a-537d-4c17-abce-44f359579fac/6602610146.pdf
- http://narolojekidutaj.rf.gd/current_affairs_2020_quiz_in_english.pdf
- http://ferenekukosazu.epizy.com/christmas_songs_telugu_2019.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000cce5.bin` `7abc7a0bb999b452996abb6a90f2a97ff08d0e89bf7945f3efb4fb11c9024a90`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCCE5	5400 bytes
`font_01_sfnt_off0000df37.bin` `960feb03c45ce13b0ccf388857f61acca66e1b13bc0db92750b3599335c85162`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDF37	10392 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.