PDF malware analysis — malicious · db488d1f999defd3

MALICIOUS

PDF

76.3 KB Created: 2021-03-19 00:12:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 96ecd5541fb2bf3b4c231b3c03107354 SHA-1: e01b83e894024caf0ceba3cebbeecc7dca01110f SHA-256: db488d1f999defd3c9dbda0738f31779108a70b7d051c9f924e82b55a2f9d3e5

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. The document body is heavily obfuscated, but the presence of the URI suggests a phishing or social engineering attack.

Machine Learning

Nyx PDF Classifier malicious score 0.9993

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/wix?keyword=hawaiian+feather+cape
- http://xuzerujagojagip.scienceontheweb.net/jesirujuk.pdf
- http://tikanaw.mypressonline.com/sharad_upadhye_books_marathi.pdf
- http://pawezujexas.mywebcommunity.org/vacuum_die_casting_process.pdf
- http://misifebofol.mywebcommunity.org/mavogaselum.pdf
- http://vezapom.iblogger.org/antecedentes_historicos_de_la_diabetes_gestacional.pdf
- http://lakujalinifibo.mypressonline.com/what_are_the_weight_training_exercises.pdf
- http://sobovonoralap.iblogger.org/sonotizogujesot.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/tokit/48041558346.pdf
- https://s3.amazonaws.com/tufujifinobiro/rapavipifuramusom.pdf
- http://dajidagetulawu.epizy.com/blaze_tv_channel_guide.pdf
- http://bolilolu.epizy.com/fema_hurricane_maria_after_action_report.pdf
- http://zimufoduso.rf.gd/6230947496.pdf
- http://ruxezila.epizy.com/83182088241.pdf
- http://norevevada.rf.gd/31395337312.pdf
- http://biborufa.epizy.com/sivemexowotomiripanubaji.pdf
- http://nalakakowim.epizy.com/fujinonelezibivomoseru.pdf
- http://satovimowenijor.myartsonline.com/agarose_gel_electrophoresis_of_rna.pdf
- http://zunuwovadete.epizy.com/mathswatch_worksheets_answers_ks3.pdf
- http://temusifima.rf.gd/18628602137.pdf
- http://ziwemasux.myartsonline.com/78867471915.pdf
- https://s3.amazonaws.com/jenagubadopi/51494074734.pdf
- http://jeximojela.myartsonline.com/73957151945.pdf
- https://s3.amazonaws.com/fotojipifuzitul/annie_the_musical_full_script.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eb3c.bin` `cc0ea86e36a572bc173b511abdd8e3d7af19c3e55bd920f5f9a537b7cec4fd9c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB3C	4944 bytes
`font_01_sfnt_off0000fc21.bin` `40a3eb47d1d465bce639abfd038ea859d3fbb86df82eda148dcc9bfd5935dd4c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFC21	11560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.