Malicious PDF — malware analysis report

Static analysis result for SHA-256 17ea116db4f1cb38…

MALICIOUS

PDF

75.3 KB Created: 2021-03-20 15:06:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 57358318ad8270932ac043233d3a814b SHA-1: 88e143f170888bee39971581ae8196579ee65a75 SHA-256: 17ea116db4f1cb38a22af9c117d758e35dd6e6e3ce04d5432f448886a35891ee
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan. It contains an embedded URI pointing to 'lozipotod.ru', which is a strong indicator of a phishing attempt or malware distribution. The document body, though heavily obfuscated, suggests a lure related to 'Ms projects for beginners'. No scripts were extracted, but the presence of external URLs and the malware detection strongly suggest a malicious intent to redirect the user to a compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=ms+projects+for+beginners
    • http://xolimaked.iblogger.org/video_er_app_for_iphone_x.pdf
    • http://reduslimitalia.website/vamifugaxunasabepageraviv5irb.pdf
    • http://numitoredewatam.iblogger.org/accounting_policies_definition.pdf
    • http://zuluwububoke.22web.org/ministry_of_health_nepal_annual_report.pdf
    • http://bupimobim.sportsontheweb.net/concept_of_curriculum_development.pdf
    • http://lnstagramverifiedbadge-form.com/detorizilpt7p.pdf
    • http://kasyanbeauty.com/tutawa7ueo2.pdf
    • http://paxenazubenib.mygamesonline.org/89843612347.pdf
    • http://zixivudu.getenjoyment.net/1413531241.pdf
    • http://digitaltoolsfor.xyz/how_to_shoot_from_a_deer_standmrrdg.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://104e0e48-a4c2-4a03-8647-06ef64d4e6ac.filesusr.com/ugd/e2c6c1_80a6f889ba234cad8f91dda5ec041109.pdf?index=true
    • https://d1159ab4-cbf5-42eb-897b-83a5e94cd7da.filesusr.com/ugd/536122_36ce20449c7a440090183b7bc5847d08.pdf?index=true
    • http://pibusobi.epizy.com/kcet_2018_physics_answer_key_set_c.pdf
    • https://s3.amazonaws.com/vunizi/autostrada_a2_niemcy_aktualne_informacje.pdf
    • https://s3.amazonaws.com/vavejijitatofu/burewova.pdf
    • http://vitoretosobiv.rf.gd/adverbios_de_frequencia_em_ingles_exercicios_com_gabarito.pdf
    • http://sojoramuf.epizy.com/13847323569.pdf
    • http://lokatetaf.rf.gd/simple_english_learning_stories.pdf
    • https://s3.amazonaws.com/febopa/62658872528.pdf
    • https://s3.amazonaws.com/jivamubug/what_to_do_when_a_girl_gives_you_one_word_answers.pdf
    • http://tukozadagafewan.rf.gd/runarisuzozex.pdf
    • http://negekipewunej.epizy.com/banjo_movie_ringtone_pagalworld.pdf
    • http://gudanomakorake.epizy.com/ccdc_2_2020.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e92f.bin
b5a5b1abb57808031d6e7c15bf980f57a35fa15b32a7b65415965ab3ee4288b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE92F 5164 bytes
font_01_sfnt_off0000fae6.bin
e8ec2a8a440ca600b7b6e1fa1eb0b580b328d97ec07bfb4bc2424350754d0ed5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFAE6 10320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.