PDF malware analysis — malicious · fbc7536f9eb047a6

MALICIOUS

PDF

73.7 KB Created: 2021-03-10 01:03:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 86964e88c7900c6754991fc7449020ab SHA-1: 76df1af43b490cb0448ee0b1ff9f5e43b1da5874 SHA-256: fbc7536f9eb047a6dc7cc49c9668d9624993ab512eed75b8a902e900e4e307d2

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains an external URI pointing to a suspicious domain, likely intended to trick the user into downloading a malicious payload. ClamAV detection and ML classification strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ponafet.ru/award?keyword=geological+map+of+texas+pdf
- http://gasurorir.sportsontheweb.net/21257084905.pdf
- http://fufejezonodim.mywebcommunity.org/convert_word_doc_to_paint.pdf
- http://hempmap.ru/baldurs_gate_3_multiplayer_issuesuqldz.pdf
- http://kanshoper.site/25602754648fd8h3.pdf
- http://kisagek.22web.org/theme_of_imperialism_in_heart_of_darkness.pdf
- http://igonlinesupport.com/words_their_way_assessments5agk4.pdf
- http://rozikukaganu.22web.org/gijazubodawejowupobo.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://uploads.strikinglycdn.com/files/313f251d-cce3-493c-b050-b9a8eb193348/paulo_coelho_quotes_11_minutes.pdf
- https://uploads.strikinglycdn.com/files/d7fb4e8d-9496-4f0b-a065-860d2e56fdc1/hp_officejet_6500a_ink_cartridges.pdf
- https://s3.amazonaws.com/wukevirenesu/zabap.pdf
- https://s3.amazonaws.com/dapekufoxiraku/linked_list_using_template_c_program.pdf
- http://gifesikubelazu.epizy.com/bagizosetalarek.pdf
- https://9c43cb74-45e3-47de-9527-fda2e8336169.filesusr.com/ugd/af0aa9_a108f48f6d24486da4cf70c6f1aa7634.pdf?index=true
- https://1350f94c-8d6f-42b4-8351-24983ad6a49a.filesusr.com/ugd/4aae87_f4cdc81d3f6941feb9707dc54ef02a07.pdf?index=true
- https://s3.amazonaws.com/didowugorokirug/brave_browser_tor_android.pdf
- https://3f5765b5-411c-4b28-96d1-a1e3b219bcee.filesusr.com/ugd/ca847e_bb6b5e10cce64c6ca4301702abc6eb47.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e32d.bin` `c8c289770cc3436a608d41ffbf695279b118ac6a85678de699537403923cc26b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE32D	5480 bytes
`font_01_sfnt_off0000f5d2.bin` `569f52043b034632fc98c57e082134de201db64c3bbc22382cc8f662dfbe25af`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF5D2	10568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.