PDF malware analysis — malicious · fdbdcc7458460f0a

MALICIOUS

PDF

94.1 KB Created: 2021-03-17 13:08:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: deb5b0c5953402f70b8ec08c948b2f77 SHA-1: 01aafdd5a3ca6b8ae1beb6a2b06f47fe2e229bab SHA-256: fdbdcc7458460f0a59e05fd750df6e5367f4facd7e291c735803eda727126fa3

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that redirects to a malicious domain, likely to deliver a phishing page or malware. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to 'Amharic bible study pdf'.

Machine Learning

Nyx PDF Classifier malicious score 0.5157

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED

The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://pelibifir.ru/award?keyword=amharic+bible+study+pdf
- https://cdn-cms.f-static.net/uploads/4413122/normal_5fd5f5079dd64.pdf
- http://tuvosudokalidu.scienceontheweb.net/tubetujamatarixezewopit.pdf
- https://cdn-cms.f-static.net/uploads/4470836/normal_60488a343d790.pdf
- http://xilatotes.sportsontheweb.net/karefopulupepifitabimum.pdf
- http://wusodopepufex.66ghz.com/11505404937.pdf
- http://zefikono.22web.org/allaire_state_park_map.pdf
- http://zibepifutidi.sportsontheweb.net/sekuxizoparobazupu.pdf
- https://cdn-cms.f-static.net/uploads/4446944/normal_60184789f0298.pdf
- https://cdn-cms.f-static.net/uploads/4423148/normal_601d5eda96a56.pdf
- https://cdn-cms.f-static.net/uploads/4481828/normal_6048aa1ba1c94.pdf
- https://cdn-cms.f-static.net/uploads/4374188/normal_5fdc3e116dde7.pdf
- http://patewukezevo.iblogger.org/komexosorapenikiloribufe.pdf
- https://static.s123-cdn-static.com/uploads/4423137/normal_5fcfb71ef02a9.pdf
- http://fejelomixariji.22web.org/87396656568.pdf
- http://kenugizi.getenjoyment.net/99_topics_ccfp.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://mevonaku.rf.gd/62864101913.pdf
- https://s3.amazonaws.com/jujadodedaruxix/ferizu.pdf
- https://s3.amazonaws.com/lonozote/sakenavivok.pdf
- http://tiriburud.rf.gd/85732892844.pdf
- http://pobopujobezov.rf.gd/27279251098.pdf
- https://s3.amazonaws.com/rezugekolaba/my_talking_tom.pdf
- http://tepezuxuliw.rf.gd/sushanta_paul_notes.pdf
- https://s3.amazonaws.com/jovekus/sixaros.pdf
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e825.bin` `d95a1df6a4f079f610f389f2368842e5535fc5dab64326e83cc799883df3921e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE825	32860 bytes
`font_01_sfnt_off00013e54.bin` `a5aad84dc6ca8f9260ff05191365786639f7fdf6e0693236295f337ea917cecf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13E54	5628 bytes
`font_02_sfnt_off0001514e.bin` `70b40c376cfe6e497f7f73bc8626e0327825fd035d58d6fdba9bcfdb8656ffb0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1514E	11168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.