PDF malware analysis — malicious · f237de81a5d993b6

MALICIOUS

PDF

87.5 KB Created: 2021-07-14 02:08:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: a5bf19ba2fc69c7afc545f2a141469fa SHA-1: 2fe3b4af35aec7a0f82f9bc5aae0511ba4ca0c57 SHA-256: f237de81a5d993b64f84876abc2773a13c9e08bd77301aa8a817a9d486b899bd

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains an embedded URI pointing to a suspicious domain, identified by ClamAV as Pdf.Phishing.Trojan. The ML classifier also flagged this PDF with high confidence. The embedded URL likely serves as a lure to a phishing site, aiming to trick users into downloading further malicious content or providing sensitive information.

Machine Learning

Nyx PDF Classifier malicious score 0.9915

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://synerhu.ru/square?utm_term=data+structures+and+algorithms+in+python+solutions+pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e87bb074000c7cf29f291e/1625848752258/lorabupibugoximujobi.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60e8f42cf107ff2467e7183d/1625879596949/94080231562.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec98c780388a1034d8f70a/1626118344099/what_does_annealing_brass_do.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60e89ba2d1513b1e6cf7bbec/1625856930441/93656808264.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ee0ae0f72ce0266e0bbbcb/1626213089849/plant_and_process_engineering_360_michael_h_tooley.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60eddde6cc8e436e46655620/1626201574781/theme_of_the_story_the_holy_panchayat.pdf
- https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60eddf279779423221dffa89/1626201895750/68746341381.pdf
- https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e8ec8ce6a58043b68f0258/1625877644214/52150832453.pdf
- https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ec91d9f6fc466b5bf45d7f/1626116569541/fuvufanexukidaw.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f257.bin` `8cb34e46f08907bee7aace552b5f68c7f43191517f1803131bf2c2a1fa032b8e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF257	17312 bytes
`font_01_sfnt_off00011f83.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11F83	16792 bytes
`font_02_sfnt_off0001379a.bin` `adef4861334018c1a41dd6b476ae0d5209648c09f9c90fa31abc38ff1129891a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1379A	11280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.