PDF malware analysis — malicious · f78445068818d44f

MALICIOUS

PDF

91.4 KB Created: 2021-05-15 10:55:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 493bf68ddc22c35a262b9428c4bf15fb SHA-1: 2b2db476d0e8f479eadc4845da8fcc37d466e956 SHA-256: f78445068818d44f3d4380fb05ab09b9ddede74c7a9ea40aaddd522ab320aefa

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL. The ML classifier and ClamAV detection strongly indicate maliciousness. The embedded URL points to a domain that is likely hosting a malicious payload, disguised as a printer driver. No scripts were extracted from this sample, but the PDF structure and embedded URI are indicative of a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://maypoin.ru/strik?utm_term=epson+wp-4530+wifi+driver
- http://tututot.mygamesonline.org/although_despite_however.pdf
- http://lapitubemexidi.mywebcommunity.org/bratstvo_crnog_bodea_14.pdf
- https://cdn.sqhk.co/zotofoza/9n0Jnia/asphalt_6_apk_pour_android.pdf
- https://cdn.sqhk.co/temegolu/gmgfrhi/75764410330.pdf
- http://kugaraginoja.mypressonline.com/39141210327.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://bufijonewufo.onlinewebshop.net/nivojesapakudolip.pdf
- http://begupegag.epizy.com/inferencing_worksheets_kindergarten.pdf
- https://s3.amazonaws.com/miledu/3rd_grade_math_fractions_worksheets.pdf
- https://uploads.strikinglycdn.com/files/37aa2a6b-390b-4f9a-aaa3-bf0b52efbf3d/sullair_compressor_oil_cross_reference.pdf
- https://s3.amazonaws.com/zarevizebi/sewoninopuvasisamegix.pdf
- http://farovosodiwes.atwebpages.com/cell_biology_for_neet.pdf
- https://s3.amazonaws.com/xupovobejanam/3931300910.pdf
- http://lenoguxeg.rf.gd/how_to_do_21_day_sugar_detox.pdf
- https://s3.amazonaws.com/dudujopixejikug/71247263712.pdf
- https://uploads.strikinglycdn.com/files/faca40bc-aefe-4181-9e3c-5eb3d1933703/program_genie_excelerator_keypad.pdf
- http://femagela.myartsonline.com/navabon.pdf
- http://jasopiwutuv.epizy.com/11614800570.pdf
- http://wudafozejuniv.rf.gd/54822971760.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0001248c.bin` `c075b712b60830a917f21892039071011e20eddbd9ff3c463b8a3031f8e1ea3e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1248C	5452 bytes
`font_01_sfnt_off0001375e.bin` `be5bc938872255a66bd4188027ac0181f3381e69ea35d9dbd5072aa9b78055d4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1375E	11908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.