Malicious PDF — malware analysis report

Static analysis result for SHA-256 07698ea291ba2d21…

MALICIOUS

PDF

81.1 KB Created: 2021-05-10 02:35:24 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 435fbf0b7fdfa26860934ae5dc9dfb47 SHA-1: d7cc47a0d0900f4198d5e8349d4ca780ea8a55b9 SHA-256: 07698ea291ba2d213a4a55c857231297160bebbc4787d08c782a33aa4bbad496
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'nipisod.ru', which is likely used to host a phishing page or download a secondary payload. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often abused for creating malicious documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=mm+to+m%255E2+conversion
    • http://d2-club.ru/which_bible_is_most_accurate824ds.pdf
    • http://stixlife.info/cruise_line_jobs_in_tampa_floridaaojek.pdf
    • http://flathead.us/how_to_compress_a_in_adobe_reader_x7hxhe.pdf
    • http://zahlungsservice-ch.site/what_is_the_scientific_definition_of_mitochondriai3fpt.pdf
    • https://favotofuti.weebly.com/uploads/1/3/1/8/131871633/9015363.pdf
    • http://raisinshq.pro/how_to_spawn_a_helicopter_in_gta_v_pc1u358.pdf
    • https://pilogowizimofog.weebly.com/uploads/1/3/4/6/134604263/kikiburil.pdf
    • https://lexikusu.weebly.com/uploads/1/3/1/4/131438729/wabawodupimem.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/xujitezu/video_helper_conversion_license_key.pdf
    • https://5ac9d038-517d-4536-97f6-676423289421.filesusr.com/ugd/b444d4_c96a56d23c1c48e89deb85e366e0d27d.pdf?index=true
    • https://s3.amazonaws.com/bezutu/goat_simulator_ps4_trophy_guide.pdf
    • https://uploads.strikinglycdn.com/files/7235a2a5-b9b0-45cf-ba3d-3ffc68340546/biology_genetics_review_worksheet_answer_key.pdf
    • https://s3.amazonaws.com/kiremefegonar/3701080721.pdf
    • https://933527c5-e005-4225-a3aa-05fee46c7696.filesusr.com/ugd/b51dd5_c008e82f9a244759874eede150acd323.pdf?index=true
    • https://ee42ee57-4547-4a8c-8a66-6cccb7f6869d.filesusr.com/ugd/2a9ad2_942e90b141cb4b0296127cf6c97258a2.pdf?index=true
    • https://0315d410-4255-45a3-9477-873949dd02ac.filesusr.com/ugd/f85006_f5bb190a93c94e188aa25d4fc0d969c9.pdf?index=true
    • http://fegarezitima.rf.gd/godamajobi.pdf
    • http://kizuwopo.epizy.com/bakatumemevukagusos.pdf
    • http://fipivolakiwupod.rf.gd/xuwolasadugumupinefozug.pdf
    • https://uploads.strikinglycdn.com/files/abc55614-9bed-4adb-addf-c499ccfdf3df/how_to_replace_stinger_bug_zapper_bulb.pdf
    • https://uploads.strikinglycdn.com/files/5b26e967-48b2-4f58-9726-db86f5662b44/read_appsettings.json_c_.net_core.pdf
    • https://s3.amazonaws.com/tugabijenovili/how_to_reset_maytag_centennial_washer.pdf
    • https://s3.amazonaws.com/bakoloj/nopotevowawosadoletit.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e97d.bin
dc750ab3e12c839b7e82438bada4b09b452fcc46819b29c2ff42573f8b20115c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE97D 4948 bytes
font_01_sfnt_off0000fa5d.bin
08bde297f26c6f4581216d19259011a9bf42ed98e45697be496081caf24d1089		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFA5D 10956 bytes
font_02_sfnt_off00011ffe.bin
d7ee14f66ae469d8303d1ef74a296899217b66f363d3cd81a177c3917d221563		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11FFE 16244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.