PDF malware analysis — malicious · fff950d746e31dc4

MALICIOUS

PDF

90.7 KB Created: 2021-03-04 05:19:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c5593d3ed96521e1502700f5c9659e0d SHA-1: bfcaddce3045bec556f0310e540a0bd42db79799 SHA-256: fff950d746e31dc4826fd1966918426ac37d0f76d46ca2e24a8d50a93618e762

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified by the PDF_URI heuristic. The ML classifier and ClamAV detection strongly indicate maliciousness, with ClamAV specifically flagging it as Pdf.Phishing.Trojan. The embedded URL likely serves as a lure to a phishing or malware distribution site, aligning with a spearphishing attachment attack pattern. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://resalured.ru/123?utm_term=what+are+parallel+lines+and+transversals
- http://xuzerujagojagip.scienceontheweb.net/2002_buick_rendezvous_service_manual.pdf
- http://posiriwase.22web.org/arnold_schwarzenegger_bodybuilding_program.pdf
- http://rubewox.sportsontheweb.net/52141933105.pdf
- http://jidokove.scienceontheweb.net/wozopin.pdf
- http://fasekafalig.scienceontheweb.net/51860883326.pdf
- http://edayafar.xyz/2006_ford_6.0_diesel_turbo_rebuild_kit6huon.pdf
- http://zutatowatipo.mywebcommunity.org/peter_drucker_managing_oneself.pdf
- http://cheapestshop.xyz/lauren_lapkus_looks_like_dj_quallsscjx2.pdf
- http://begemotiks.space/xipujomibx9tw5.pdf
- http://jilet2.club/factoring_the_difference_of_cubes_worksheetbokq4.pdf
- http://hook-up.fun/kagitawazit4h3on.pdf
- http://all-gopro.com/64649959984aaph7.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://pabotojixupi.atwebpages.com/guwokabekivuzibef.pdf
- http://nuxumejaxumem.epizy.com/muxejiravejapufibolujuw.pdf
- http://buwanizun.epizy.com/fetal_bradycardia_nice_guidelines.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010dea.bin` `9d53f36beb141602361cb04799f91779e5c1b16bb5b83592d9d39c0fe8240fb8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10DEA	5120 bytes
`font_01_sfnt_off00011f5f.bin` `4ecad6065da7eafa81818199da9f4d7d7dc590fbe9580d910f1bea3fe84d8ea4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11F5F	12220 bytes
`font_02_sfnt_off00014817.bin` `0de4e250ee93c0785e0e1083dcf992dd4c871ff9b24a61d37e5402e062f817ac`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14817	16296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.