PDF malware analysis — malicious · ea50ad92d33d8358

MALICIOUS

PDF

76.6 KB Created: 2021-05-13 07:50:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 98cc5a213a596513d46257f19a98ca37 SHA-1: 24c3c3d77a7e57f0bcc064ca3b38c4fe21da7820 SHA-256: ea50ad92d33d8358d51d06e380018166b6932da6a0d3e22523949f02f07be02a

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an external URI pointing to a suspicious domain, likely intended to host a malicious payload or phishing content. The document body, though heavily obfuscated, contains metadata that could be part of a lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/strik?utm_term=what+is+definition+of+community+survey
- https://cdn-cms.f-static.net/uploads/4414176/normal_604145f219186.pdf
- http://flipping-car.online/4k_video_er_websiteo1l5e.pdf
- http://nextauto02.ru/doteresimiritivbytee.pdf
- http://marketitaly.info/zuvaxizebalavidanokavapuwpnv8j.pdf
- http://fakaripeti.xyz/coin_counter_close_to_mesj9yc.pdf
- https://cdn.sqhk.co/rizavoxaje/nCRggHv/kiwosapoladunikoj.pdf
- https://cdn.sqhk.co/pigalixow/kXghHjf/8d_music_player_pro_mod_apk.pdf
- https://cdn.sqhk.co/silinetufid/bOXBji1/oceanhorn_2_switch_price.pdf
- http://tehnotop.space/mokedakelepuwi19k1b.pdf
- http://idealica-italiaufficiale.website/55238397558izt0.pdf
- http://dalnoboyi.xyz/kikowomewewanizezubiz9uh0.pdf
- https://static.s123-cdn-static.com/uploads/4480148/normal_5fc94d385e086.pdf
- https://cdn.sqhk.co/vofonowul/ighcTon/astuce_de_grand_mere_contre_la_toux_bebe.pdf
- http://podipotekoi.ru/fefugesepobuxub1w2u.pdf
- http://reactivaperu-2020.com/24236457649sa980.pdf
- https://cdn.sqhk.co/jagapifa/hgiwgg8/juicy_fruit_song_chords.pdf
- https://cdn.sqhk.co/pepupiribojo/jhS0jbk/87703105731.pdf
- https://cdn.sqhk.co/vabolepibe/ii9uu5a/spectacular_meaning_in_tamil.pdf
- https://cdn.sqhk.co/nudabesawi/gdnieie/scp_site_19_2004_map.pdf
- https://cdn.sqhk.co/koxuvusu/QMijaic/xelekijivinanitofuwureze.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/jifedefujodu/9529313794.pdf
- https://s3.amazonaws.com/sizadagazagaj/1325087880.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000eb15.bin` `85186dcd7d828e93f0bbe56afedfb32456e62d58cde19d1bfb2228a2167d5fcc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB15	5404 bytes
`font_01_sfnt_off0000fd64.bin` `9d68b501d91024cd0581dd1b17a909aa0e220d60479900e93d56058cf9bef88d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFD64	12488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.