PDF malware analysis — malicious · e44e3909bdd1f675

MALICIOUS

PDF

77.7 KB Created: 2021-03-23 20:14:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: a08b2c721515717973bf697d526ed829 SHA-1: efbf3c8e83d2b4845e4ed4547f7614e2b0eca27b SHA-256: e44e3909bdd1f6758f3cfba3a7829184e3c7fd33f928ab430f22a367a0f4590f

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. The embedded URL points to a suspicious domain, suggesting a phishing or malware distribution attempt. While no scripts were explicitly extracted, the PDF structure and heuristic firings strongly suggest it's designed to trick users into visiting a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/aws?utm_term=how+to+find+common+ratio+geometric+series
- http://grantmedica.ru/colegio_de_enfermeras_profesionales_de_honduras_direccionnw4hz.pdf
- http://boevoenlp.com/wonderwall_projector_troubleshootingua08n.pdf
- http://gisoboxizaza.mygamesonline.org/53178029232.pdf
- http://bonifacy.site/honkai_impact_3_guide_indonesiaeae04.pdf
- https://kebotufu.weebly.com/uploads/1/3/4/7/134735966/9533560.pdf
- http://boost-shop.xyz/how_to_build_a_small_flying_droneedav0.pdf
- https://lasemekesote.weebly.com/uploads/1/3/4/3/134314396/8107950.pdf
- http://vienvozvrat.site/capresso_ec100_espresso_machine_manualsa4fo.pdf
- http://resapus.scienceontheweb.net/11560744979.pdf
- https://ribifafugulif.weebly.com/uploads/1/3/4/6/134650062/2242463.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/43aaaf1a-a82b-42c9-9659-3ba4598d69e9/20446540000.pdf
- http://totuxivez.onlinewebshop.net/77726929189.pdf
- https://uploads.strikinglycdn.com/files/34ae7b1d-f429-40d8-a654-1b966783ddd1/how_many_carbs_in_street_taco_tortillas.pdf
- https://a2876ee3-c470-454a-91e2-e108d831033a.filesusr.com/ugd/e8dba5_7e121e0a84104bc8918f92b975070380.pdf?index=true
- https://uploads.strikinglycdn.com/files/2ec5589c-f2f0-4247-b405-ecd7be1ab7bf/94450832129.pdf
- http://vefodipox.myartsonline.com/counterproductive_work_behavior_questionnaire.pdf
- https://s3.amazonaws.com/wezukep/beretta_px4_storm_compact_carry_manual.pdf
- https://s3.amazonaws.com/begijufadi/vasolabasug.pdf
- https://uploads.strikinglycdn.com/files/88a7b3c5-b031-4a2e-a1d2-ec5b7b054860/dictionary_of_architecture_and_construction.pdf
- https://3789e5f8-265e-48cd-8836-241a044b7ceb.filesusr.com/ugd/45ef7e_f70b72fc16994b68a0a2d276f269e153.pdf?index=true
- https://6129906d-bc82-46a7-99f5-71793a58af3c.filesusr.com/ugd/d162e3_e3f1f3950ef748f18a569bbdc4138550.pdf?index=true
- https://s3.amazonaws.com/toniseligiwuzux/mapilozofa.pdf
- https://uploads.strikinglycdn.com/files/87aabf2f-6a9f-4c99-a1e2-806ecc94ddbd/sting_when_we_dance_lyrics_deutsch.pdf
- https://s3.amazonaws.com/fekife/25036551606.pdf
- https://s3.amazonaws.com/vuzufexarevima/73771960662.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f263.bin` `a361cd5743bb06fe5a0985e7557b861a4fc946ed80d8b35fd42d7f7378c3ac4e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF263	5360 bytes
`font_01_sfnt_off00010497.bin` `b0b9cbffede7cb0ba11ccca2faeaf8a25715ab7f451ba5c28b26e808a0e5da3d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10497	10624 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.