Malicious PDF — malware analysis report

Static analysis result for SHA-256 18c8b09e019be22e…

MALICIOUS

PDF

79.3 KB Created: 2021-03-28 23:06:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1f67f79e29405501a1c717c25305d442 SHA-1: 27fc2f1968a6656be0cc6123da2543cd98f6a914 SHA-256: 18c8b09e019be22e4a3d2edcdfaf1b5915ee683db50c1b5836b70febbd6f22b3
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'nipisod.ru' and a heuristic indicating a visual download button lure suggest the document is designed to trick users into clicking a link to download a payload. The document body contains garbled text, but the URL and heuristics strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=turnitin+free++for+windows+7
    • https://static.s123-cdn-static.com/uploads/4413563/normal_5ff8940bc178e.pdf
    • https://cdn.sqhk.co/mofokamibe/3ihZAhc/55097158829.pdf
    • https://cdn-cms.f-static.net/uploads/4412763/normal_600d99769bf56.pdf
    • http://fesifula.22web.org/duxuna.pdf
    • http://janafan.scienceontheweb.net/12685721977.pdf
    • https://cdn.sqhk.co/joxesinejag/sigUTHg/gebuwupebozakojenowan.pdf
    • https://cdn.sqhk.co/letarezetap/Goge6ib/lean_bulk_workout_plan.pdf
    • http://jekeluxuto.mywebcommunity.org/computer_chair_high_weight_capacity.pdf
    • https://cdn.sqhk.co/xitilesuxiw/hbjghhu/bloons_td_battles_hack_ipad.pdf
    • https://cdn-cms.f-static.net/uploads/4496818/normal_5fd8231eeb4b0.pdf
    • https://cdn.sqhk.co/lulaxujik/eDgjMjj/beli_pulsa_di_shopee.pdf
    • https://cdn.sqhk.co/gufezitaxato/tibgjhf/talking_alarm_clock_free_download_for_android.pdf
    • https://cdn-cms.f-static.net/uploads/4452852/normal_6012c58d66f70.pdf
    • https://cdn-cms.f-static.net/uploads/4454807/normal_6028b8cdb2918.pdf
    • http://simenomevaxi.iblogger.org/75728271436.pdf
    • http://sawemawe.mywebcommunity.org/zoxuvulifukikoze.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/dogazisuze/online_admission_form_sree_chaitanya_college_habra.pdf
    • https://s3.amazonaws.com/mexijegedakol/six_pack_abs_workout_at_home.pdf
    • https://s3.amazonaws.com/xisefowu/42929111697.pdf
    • http://muropij.epizy.com/how_to_contact_starbucks_rewards.pdf
    • http://sipanokule.onlinewebshop.net/kovebovululidut.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb35.bin
1a15d394e75c7bcc25acbe7ec1b64b19ab5fea1783b84ea45b87469c485ef306		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB35 4660 bytes
font_01_sfnt_off0000fb36.bin
7c83e3a7a07636a02525631291ecc4fec0ded6b739ffe2498f181b9f0bada1f1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB36 11512 bytes
font_02_sfnt_off000121fd.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x121FD 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.