PDF malware analysis — malicious · fd963c9aa5291381

MALICIOUS

PDF

71.4 KB Created: 2021-02-24 18:14:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-23

MD5: 4fdd729db793606e3c1efae77f1e8621 SHA-1: 4b8441ef013e65fb446e7779dfbf5810c66c55f0 SHA-256: fd963c9aa5291381217f77a95ea2265702bdb6feff06ad059890da6d294a888d

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a machine learning classifier and ClamAV, indicating malicious intent. It contains embedded URLs that likely lead to further malicious content or phishing sites. The document body, though heavily obfuscated, suggests a lure related to search terms, reinforcing the phishing attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://jottigo.ru/wb?keyword=pse%20stinger%20extreme%20vs%20bear%20cruzer%20g2 PDF link annotation
- http://arboozfilm.com/lesatubs0ntf.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4388833/normal_5ff13441298fc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4413567/normal_602fd83d3e6b8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4487902/normal_5fd651327486f.pdfIn PDF document text
- http://clobuss.ru/mudekalevajavedif70qjv.pdfIn PDF document text
- http://flash-sar.online/70817074122fd2sj.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4418383/normal_5ff3b64139b30.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4415935/normal_5fd7a90b592ac.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/suxugipipolazog/nifidazedufunuxezedapirok.pdfIn PDF document text
- http://dibulazovila.rf.gd/vshare_for_mac.pdfIn PDF document text
- https://s3.amazonaws.com/bisegilupuf/cch_chuyn_file_nh_sang_word.pdfIn PDF document text
- https://s3.amazonaws.com/lixasifasi/bracket_songs_audio.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000d855.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xD855	5536 bytes
SHA-256: `e2c804cecf0c844d54bd8d41b40e97b3e2ca7518f1fcb3896857de44486f5974`
`font_01_sfnt_off0000eb2c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEB2C	11472 bytes
SHA-256: `9aefd763b37c1ee25cefd21be9a3241765e832e47c81f4b11a970fb889aeee7b`

Open this report in the interactive analyzer, or submit your own file for analysis.