PDF malware analysis — malicious · e0d650589275e3b7

MALICIOUS

PDF

87.9 KB Created: 2021-03-23 02:17:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 1aa47c7d40c55ac1ab8c1419b8ef396a SHA-1: d69ec891771064e92bdf5269700e397628134dcc SHA-256: e0d650589275e3b7783d0e32bd06daa7fcf2f6a702b35fe15855f4a80102fa52

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing site. The document body is heavily obfuscated and unreadable, suggesting an attempt to hide its malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://soxebez.ru/award?keyword=budismo+nichiren+daishonin+pdf
- https://cdn-cms.f-static.net/uploads/4428341/normal_601f13888f388.pdf
- http://todayshop.website/what_is_islam_religionecp7b.pdf
- https://static.s123-cdn-static.com/uploads/4452217/normal_5ff2cb117c948.pdf
- http://basiditdcf.space/85495313485owrng.pdf
- https://cdn-cms.f-static.net/uploads/4389821/normal_5fd2cfc4cc1dd.pdf
- http://dusibarupuguli.medianewsonline.com/xupofosatilosukadifobimud.pdf
- http://vurejowug.mypressonline.com/50816525486.pdf
- http://zevupixikug.mywebcommunity.org/behavioral_approach_to_leadership.pdf
- http://ginalupajeriw.scienceontheweb.net/87924930131.pdf
- http://bodulotol.22web.org/7640694885.pdf
- https://cdn-cms.f-static.net/uploads/4475564/normal_5fea28efbed82.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/5a31c76c-ce25-4653-9d3b-516a35162800/97100303406.pdf
- https://uploads.strikinglycdn.com/files/ad7555f6-fbfb-41b9-90e1-f5c10b467500/61121729722.pdf
- http://soxuxemakim.rf.gd/powermax_8000_price.pdf
- https://uploads.strikinglycdn.com/files/92f13ab9-e7b7-45ec-aea6-ade55fc1bd6a/pugeratoli.pdf
- https://uploads.strikinglycdn.com/files/8a70d82a-6fd9-4536-8c85-4f05ae94c683/narasimha_karumanchi_data_structures_and_algorithms.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000feee.bin` `2984767d14b266a3d974a2f522c6977dd22bbca8a10846e34a450a9dac237c33`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFEEE	6896 bytes
`font_01_sfnt_off00011659.bin` `44696986cb83379012f08259f00d64f19166d6b4d081bc5db296bb74d4ac7b0b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11659	5412 bytes
`font_02_sfnt_off0001289d.bin` `19fbb94b491ddbe50318e886f28600087597b861ef84d3e03dba32d4a009f284`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1289D	13464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.