PDF malware analysis — malicious · e93a05978aca8845

MALICIOUS

PDF

161.4 KB Created: 2021-03-11 08:30:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25

MD5: 0d7c96c85b5d12e0c1120f22fca3388b SHA-1: d914e38ea96de42b0a0fa549730152e3018e478e SHA-256: e93a05978aca88452b17a8114f1f17f2307f08ffb5a15bfd287d896cd861e206

116 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. It uses a callback-phone (TOAD) lure. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

Nyx PDF Classifier malicious score 0.9977

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kuzutuzo.ru/123?utm_term=brown+kraft+paper+sheets+wholesale PDF link annotation
- http://depofukug.iblogger.org/78384547442.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://fedorahosted.org/lohitIn PDF document text
- https://s3.amazonaws.com/ritoma/jutavigasul.pdfIn PDF document text
- http://pewusufep.epizy.com/nespresso_cs20_milk_frother_manual.pdfIn PDF document text
- https://s3.amazonaws.com/bubodeliza/lagu_aking_prinsesa_gimme_5.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/adb20a01-0253-47d5-b12e-266dcab222aa/gozizekinakawurugaganu.pdfIn PDF document text
- https://s3.amazonaws.com/satedafadusizo/26470238933.pdfIn PDF document text
- https://b1b1ed1d-a631-407f-b8a0-2f609481a9c2.filesusr.com/ugd/3e5895_a451c99659a1412b8215e5940e57ff58.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/legenapi/tupotodegox.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/124c0dc7-d025-48b3-960c-ddfe13e3ff24/zipufawenumerusopidadip.pdfIn PDF document text
- https://s3.amazonaws.com/gupojakami/generic_bluetooth_radio_driver_windows_10.pdfIn PDF document text
- https://bdc3fad0-85dd-4e34-85f7-620d54d4ff6f.filesusr.com/ugd/10cedf_d7880e04018a4ceabde34c3cab7ca91d.pdf?index=trueIn PDF document text
- http://zinapur.epizy.com/cyberlink_youcam_7_full_crack_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2e8ef416-057e-442d-a9cc-e98b4b30b7dc/what_is_the_meaning_of_spirit_of_the_law.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/11153149-4218-455f-ada0-b2cdaf8f073d/shimano_sm-ew_wu101_di2_wireless_unit.pdfIn PDF document text
- https://2e8e3215-33bf-4fe1-bc67-b38dac560527.filesusr.com/ugd/269bb8_eb51e83d3e0c46c1b2be2ad1eb3c8fec.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/redegelesibif/33393776100.pdfIn PDF document text
- https://s3.amazonaws.com/jivagajamav/hello_richard_clayderman_sheet_music.pdfIn PDF document text
- https://s3.amazonaws.com/fapaga/android_x86_installer_for_windows.pdfIn PDF document text
- https://s3.amazonaws.com/gezizefefififa/how_to_connect_220v_outlet.pdfIn PDF document text
- https://91ca87c2-c493-4616-adaa-fbcec45394e1.filesusr.com/ugd/6116da_265553e38a464c01910a224af19143db.pdf?index=trueIn PDF document text
- https://47e4df30-8702-49a4-8bd5-327e1546ff06.filesusr.com/ugd/379272_d8942f6a979a45648dc97e39f81c61cf.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00021c0d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x21C0D	5192 bytes
SHA-256: `6ed9e090a62c4760f80b9cdbe497735bf2d9b995d9f01ea9f43b7ec9ad85f1de`
`font_01_sfnt_off00022dcc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x22DCC	11752 bytes
SHA-256: `9c8151842574d30b21cd9ba9d6d7c2e16f2742828c71271c56f6d806b7876358`
`font_02_sfnt_off00025479.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x25479	16164 bytes
SHA-256: `e296a61d2d303e35be9e1a35631556663d2780498efa7e8f3867bf557f172fe6`
`font_03_sfnt_off000269cc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x269CC	3180 bytes
SHA-256: `4bff12b55978dcf24812bf44cee0a399ab1de60b5bbaca8587a99987d1099a7b`

Open this report in the interactive analyzer, or submit your own file for analysis.