PDF malware analysis — malicious · f5d33afdf2f4d49a

MALICIOUS

PDF

78.4 KB Created: 2021-05-17 20:37:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 82510e803a24189230e1a33a741d770f SHA-1: 16f18bd43d3e5e648a5b2cf86d19024bc699624e SHA-256: f5d33afdf2f4d49af297b9d98505b0dc05e12f3d00ab09d827df188216c4a00e

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, suggesting a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly indicate malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URI are indicative of a phishing lure designed to redirect users to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jacksth.ru/strik?utm_term=what+is+essential+and+non+essential+items
- https://cdn-cms.f-static.net/uploads/4417205/normal_6064deba44d3e.pdf
- https://tuzokoluxalof.weebly.com/uploads/1/3/1/3/131382257/6386903.pdf
- https://cdn-cms.f-static.net/uploads/4484376/normal_6021e80e9fd32.pdf
- https://mesakarune.weebly.com/uploads/1/3/1/3/131380767/38a2b.pdf
- https://vuduleputasi.weebly.com/uploads/1/3/4/4/134488699/doxalagemelaxo.pdf
- http://price-list.moscow/minecraft_free_download_full_version_windows_10_64_bit_with_crackt7v6n.pdf
- https://lufuneliza.weebly.com/uploads/1/3/2/6/132682735/5394ad5f5ab3.pdf
- https://kigimijufofudiv.weebly.com/uploads/1/3/5/9/135977026/cf350c4259fae.pdf
- http://italiahot.space/23169890018m6l14.pdf
- http://kersita.space/9755137542m06lk.pdf
- http://brumbum2.xyz/pal_soka_ocuu_izlecghr1.pdf
- https://falojixij.weebly.com/uploads/1/3/4/8/134878909/6282762.pdf
- https://sugibovipebu.weebly.com/uploads/1/3/4/7/134705953/406df093fdc600.pdf
- https://vefavufarexuba.weebly.com/uploads/1/3/4/3/134315694/7652531.pdf
- http://grenkasalo4.xyz/zinejer7pxsk.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/jitimesolagun/baaghi_1_free.pdf
- https://s3.amazonaws.com/zisulamisozoto/speech_writing_format_cbse_class_12.pdf
- https://s3.amazonaws.com/wewiro/tedaxilati.pdf
- https://s3.amazonaws.com/divelatoxa/fender_passport_300_pro_portable_pa_system.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f316.bin` `544ae248147d114ea04cd014f4c643b56c0eefa1b9c62fc4aad880258f56a35a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF316	4984 bytes
`font_01_sfnt_off000103e9.bin` `7b9bdd08352eb2ee4cdac5119551efe34698da99a6f6bb1ec46b4ae8c10753ce`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x103E9	11508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.