PDF malware analysis — malicious · f301afe2e86bd517

MALICIOUS

PDF

80.3 KB Created: 2021-04-03 10:33:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 9316c2e5293edb268b5ee9eaf3301273 SHA-1: dec33b511ced216650889805a3b745cf6a9bedd6 SHA-256: f301afe2e86bd517dea175fd99329a6a648fd3c04a9dedfc397b37fa24a936ed

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'leonvi.ru' suggests a phishing or credential harvesting attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing lure designed to trick users into downloading further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://leonvi.ru/award?keyword=chain+bucket+elevator+design+pdf
- https://cdn.sqhk.co/fifapupifig/Slgcgev/tisufevupek.pdf
- http://leledup.mypressonline.com/11719283522.pdf
- http://tufilevazoropiz.iblogger.org/50352195654.pdf
- https://cdn-cms.f-static.net/uploads/4407664/normal_6058141875701.pdf
- http://zowomojagobipur.iblogger.org/malogasar.pdf
- http://gamuxiwami.getenjoyment.net/semaduw.pdf
- http://ganoxotemifava.22web.org/telecharger_cours_excel_2020_gratuit.pdf
- https://cdn-cms.f-static.net/uploads/4417805/normal_6031cf8b7bc75.pdf
- https://cdn-cms.f-static.net/uploads/4383679/normal_60679912492ea.pdf
- http://masanakepatarar.iblogger.org/polisacaridos_funcion.pdf
- https://cdn.sqhk.co/pegidago/4ZVgjjh/69344086077.pdf
- https://cdn.sqhk.co/jobubexivex/ehafig2/98039789516.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://janarisugikev.rf.gd/automation_anywhere_tutorial_for_beginners.pdf
- http://tasowotata.epizy.com/marginal_costing_questions_and_answers.pdf
- http://kidojudal.epizy.com/music_staff_paper_template.pdf
- http://wedutatitupaze.epizy.com/presto_06857_electric_skillet_16_reviews.pdf
- http://tiwokuvaredix.epizy.com/how_to_save_config_cisco_ap.pdf
- http://ranitirunom.myartsonline.com/bezekojuduzuxe.pdf
- http://jifujurudale.epizy.com/autodwg_to_dwg_converter_2020_key.pdf
- http://zekafoforom.epizy.com/bufebedekedufavu.pdf
- http://mifavumiz.rf.gd/pentair_fns_plus_60.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fc36.bin` `97443ef7fc53803c6f1d2e6b319f3bec1064ea1512adc14c4ef761d162400793`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFC36	5588 bytes
`font_01_sfnt_off00010f2e.bin` `a178cc4b54ac85f488401ff75dbccad49ea7b54360216f717398109c0e46150f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10F2E	10652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.