Malicious PDF — malware analysis report

Static analysis result for SHA-256 17bb4806a83999c3…

MALICIOUS

PDF

86.8 KB Created: 2021-04-01 15:19:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1c7093982f949c7db989e477424bd267 SHA-1: 6361a75b4ee6103710eaaf21e21be87eda815538 SHA-256: 17bb4806a83999c33dd63657215e93afe0ca06f63b2b1210026ff4480c174230
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The embedded URL, 'https://nipisod.ru/wix?keyword=facetime+apk+for+android', suggests a phishing attempt related to downloading an Android application. Although no scripts were explicitly extracted, the PDF structure and the presence of external URIs indicate a malicious intent to redirect the user to a potentially harmful download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=facetime+apk+for+android
    • https://cdn-cms.f-static.net/uploads/4388827/normal_605d82d5ccfb9.pdf
    • http://takipibimaxubov.sportsontheweb.net/the_endocrine_system_consists_of_neurons.pdf
    • https://cdn-cms.f-static.net/uploads/4372358/normal_601f6151a130b.pdf
    • https://static.s123-cdn-static.com/uploads/4404313/normal_5fcbde6c3111f.pdf
    • http://tapavinologo.mygamesonline.org/tabad.pdf
    • https://static.s123-cdn-static.com/uploads/4366993/normal_600646a2700c6.pdf
    • http://ganitigusawev.mygamesonline.org/94468796378.pdf
    • https://static.s123-cdn-static.com/uploads/4388413/normal_5fdfff9dbad74.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/jeworurowam/fujeburoromapepib.pdf
    • http://roporuti.onlinewebshop.net/tuzivijij.pdf
    • https://s3.amazonaws.com/figidireki/rujosatisufo.pdf
    • https://uploads.strikinglycdn.com/files/d3c22cbc-ab7c-4332-969a-cf166936536d/how_to_renew_your_drivers_license.pdf
    • https://uploads.strikinglycdn.com/files/ba3ab33c-a9af-4db8-9bb6-498f328d1868/lee_county_florida_school_hours.pdf
    • https://s3.amazonaws.com/nuruvapozixix/gepupugipatina.pdf
    • http://duvodix.myartsonline.com/86801155719.pdf
    • https://s3.amazonaws.com/tevomenil/blender_2.9_tutorials.pdf
    • https://uploads.strikinglycdn.com/files/1f3c8167-69c2-4b32-8361-3f7d01fe38cc/taurus_pt111_g2_sight_picture.pdf
    • https://uploads.strikinglycdn.com/files/531eb0b8-783b-42f0-bab5-403b4cefdf50/xonozojibadurosisojuxux.pdf
    • https://s3.amazonaws.com/remavuj/xumavis.pdf
    • https://s3.amazonaws.com/kafises/tejuzotubokenafije.pdf
    • https://uploads.strikinglycdn.com/files/83332070-eeeb-4e3f-9b60-f4a6fbd526d6/family_life_merit_badge_pamphlet_2019.pdf
    • https://uploads.strikinglycdn.com/files/a9e160bc-7d37-44c9-ab87-bba0c458497a/78934270430.pdf
    • https://s3.amazonaws.com/dipafuxe/68404435513.pdf
    • https://uploads.strikinglycdn.com/files/8010da38-a055-466e-a2ca-3885983ab9d8/22866440094.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000116b6.bin
9495497ca5f9c5ed0b5f75df7831fa1b5c9d08a68e692e58a1052f9ddeaa58f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x116B6 5112 bytes
font_01_sfnt_off0001280e.bin
49b8b60006469d152b33f9f643130e577a01bda76b711f75d6d2262f71ba8b6f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1280E 10944 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.