Malicious PDF — malware analysis report

Static analysis result for SHA-256 1de5b00ac5b6dafe…

MALICIOUS

PDF

70.2 KB Created: 2021-03-15 11:22:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: c8102e0d36588c458b472b053d9a2eb5 SHA-1: d85e03c4f8c9f6d06b45429d099cff08bcecbe23 SHA-256: 1de5b00ac5b6dafe4171de89285aaf5a5f5e1ce67f99650fddaa6bb071936447
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. An external URI pointing to 'https://nipisod.ru/wix?keyword=wheeler+bore+guide' was extracted, suggesting the document's purpose is to redirect users to a potentially malicious site. The presence of embedded URLs and the overall classification strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=wheeler+bore+guide
    • http://forkidsshop.online/walmart_tv_stands_in_store8itg5.pdf
    • http://service-hire.com/55679899457erimq.pdf
    • http://getveran.site/is_audio_technica_good_record_player8wyyo.pdf
    • http://luxshop21.site/atwood_tankless_water_heater_service_manualuljsx.pdf
    • http://naturfresh.space/how_old_mason_crosby1ju7c.pdf
    • http://citimart.online/wupixobewavaa13w6.pdf
    • http://ergors.space/setutozafunojodavutobobpmql7.pdf
    • http://adminhalil.com/la_ciudad_de_las_bestias_personajes_secundariostunvm.pdf
    • http://pet-guru.shop/zuwokukofibuzibav5ekz.pdf
    • http://educationonline.website/is_there_going_to_be_a_rising_of_the_shield_hero_season_2c94a8.pdf
    • http://remont-pc.website/2756000090wp1au.pdf
    • http://899themes-demo.ru/how_to_reflect_on_a_journal_article5g654.pdf
    • http://medupaj.iblogger.org/bharat_ratna_winners_list.pdf
    • http://tikovg.xyz/best_english_learning_course_onlinen6nje.pdf
    • http://mmmmmme.space/bade_acche_lagte_hai_pihu_imagesx3pw5.pdf
    • http://questotzvezd.space/what_is_the_best_fitness_machine_to_lose_weightu6qt7.pdf
    • http://bonboxstudio.com/fafabebev6srw.pdf
    • http://bionatur.space/ganatizuwarojekugejijo14152.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://jakefubenuwep.epizy.com/aditivos_quimicos.pdf
    • https://656adf98-7a81-40bd-8d0f-2b9c27d09201.filesusr.com/ugd/268ab1_e0fff1f493ff48449047e0620005d1a0.pdf?index=true
    • http://ronapidilejok.rf.gd/camp_x_ray.pdf
    • http://wubulunonowov.epizy.com/angular_formcontrol_checkbox_setvalue.pdf
    • https://a9750898-a066-404d-a796-54a2f5ad13bb.filesusr.com/ugd/60231a_84f3a1673e7d4ec38d15f39fee76a821.pdf?index=true
    • http://dapunujunet.epizy.com/dragon_nest_sea_mobile_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d50e.bin
60633ffd369b479f29cf369c679893d64c3ea335a87ef6e65117de3895dd6a37		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD50E 4852 bytes
font_01_sfnt_off0000e596.bin
3df6887ec949003d806f2b70fd13a8ba6221e30ae09fdcd14f66464ffd807d61		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE596 10560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.