PDF malware analysis — malicious · fc68f67c4824dd2b

MALICIOUS

PDF

87.8 KB Created: 2021-07-12 20:54:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3)

MD5: 8708feaacd965a8fe47001aa5547e278 SHA-1: 30305a354d104e68225fccc930d9fe06df2a854b SHA-256: fc68f67c4824dd2b50ea1b9796ec4efcb7fad96302ec0377a0c1670506e76681

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The sample was identified as malicious by a machine learning classifier and ClamAV, with heuristics indicating the presence of embedded URLs. While the document body is heavily obfuscated and unreadable, the embedded URLs suggest a phishing or malware distribution attempt, likely delivered as a spearphishing attachment. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9526

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://feedproxy.google.com/~r/sq/ugae/~3/1LSSs5qy-i4/square?utm_term=tomato+and+basil+bisque
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e9657b37cb90447561f6b6/1625908603901/the_last_lecture_download.pdf
- https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ec7e9c3f7a034ccb7a1f77/1626111644935/friday_night_funkin_the_tricky.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e7c55fbab0621613375b78/1625802079833/download_wallpaper_one_piece_for_android_hd.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec783c5f604029b9904739/1626110012830/how_long_for_painted_turtle_eggs_to_hatch.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec7f707e5cd11affccb35f/1626111856306/third_element_of_periodic_table.pdf
- https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec7949ad1bf7105ccad114/1626110281637/from_svg_to_jpg.pdf
- https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ec7d7c59713006cbe0adce/1626111356899/difference_between_fee_simple_and_leasehold.pdf
- https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ec78f44027437375955fd3/1626110196583/58378128758.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f5ec.bin` `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF5EC	16792 bytes
`font_01_sfnt_off00010e03.bin` `b1549e4b4d750624f59aa0117a549acd3d4049b3eef2cf85869670aad55b0d04`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10E03	10660 bytes
`font_02_sfnt_off00012631.bin` `0b103a8242f00be919e539f2a0f78cebcf512ff15256694e54d68984ca9c003f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12631	16764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.