Malicious PDF — malware analysis report

Static analysis result for SHA-256 235fd43612d2b0e7…

MALICIOUS

PDF

75.7 KB Created: 2021-03-10 02:31:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-17
MD5: ae6e0e3639b47a9ab70583b6a04365c6 SHA-1: a6c13d2377108a46979f45753e75d26cf7507eae SHA-256: 235fd43612d2b0e7b4b94ccd6caf5797b03154ce017b89853f17055d585dd1b9
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'nipisod.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'Pocket guide to world religions'. No scripts were extracted, but the presence of an external URI strongly suggests a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=pocket+guide+to+world+religions PDF link annotation
    • https://cdn.sqhk.co/difigobon/jjiw6Dp/zibide.pdfIn PDF document text
    • http://bigmagazin.xyz/scotts_speedy_green_1000_spreader_settings_for_grass_seed2y69p.pdfIn PDF document text
    • https://cdn.sqhk.co/kemivabesu/gjZhdgi/zombie_rider_crazy_racing_games.pdfIn PDF document text
    • http://islandlandscapesbb.com/how_to_reset_my_printer_settings37xu8.pdfIn PDF document text
    • https://cdn.sqhk.co/xakelafu/boMjfhc/syllabus_gh.pdfIn PDF document text
    • https://cdn.sqhk.co/nemazuwigumo/hbichfk/disakewutitedezesagi.pdfIn PDF document text
    • http://erogancolumbia.site/palabras_de_enlace_en_un_mapa_conceptual9xzpv.pdfIn PDF document text
    • https://cdn.sqhk.co/kelarega/J0hfij9/mivuturanelom.pdfIn PDF document text
    • http://chategratis.online/mowedemuzijepilunakezojem340y1.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xoguwavosuje/ambarsariya_video_song_1080p.pdfIn PDF document text
    • https://49432a94-54bc-4d13-9d12-ea41d731e1b8.filesusr.com/ugd/a7c689_92fb22da4c95416ea5b2e4fe3dfda32c.pdf?index=trueIn PDF document text
    • https://011f98f8-b45f-4578-a2fd-466b530f7845.filesusr.com/ugd/74e905_9db204e9c89c4c83a52804ba04ab8b56.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/gedexim/95601821187.pdfIn PDF document text
    • https://05790d5e-93e9-4545-bcc4-99c37f081c18.filesusr.com/ugd/bff4d5_af776c382a104c2db10366139f1943dd.pdf?index=trueIn PDF document text
    • https://8e12fe21-47c1-448c-af9e-883e7c84523b.filesusr.com/ugd/52ac5e_7e9901d5f4d2403b8b6de50e0bc00cec.pdf?index=trueIn PDF document text
    • https://0f0532cb-4478-41f9-91a1-cf277c4732ec.filesusr.com/ugd/8acad3_bd1874cfa8c641bfa3a0e4a2f515b513.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/punurum/90995311972.pdfIn PDF document text
    • https://s3.amazonaws.com/legipalofi/nintendo_3ds_emulator_apk_apkpure.pdfIn PDF document text
    • https://041f977c-1598-48cb-b578-3d63f550c8ab.filesusr.com/ugd/524ae3_ca93c861a7b54b0e8e11ddeb85f6d891.pdf?index=trueIn PDF document text
    • https://32b33340-d9da-4ef7-b3bd-a0ac5134eb71.filesusr.com/ugd/adfa6f_8113cb7cf9374d3d8586619c143b5c26.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bufexa/nojikaro.pdfIn PDF document text
    • https://s3.amazonaws.com/wovedukevikov/hearthstone_dalaran_heist_chapter_1_guide.pdfIn PDF document text
    • https://a694a867-b0fa-45cd-b082-7f9abf80b1a7.filesusr.com/ugd/430cb2_300187e6c4eb4c46a37e2d0212d3c4b7.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/megulu/moment_format_locale_string.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eadd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEADD 5056 bytes
SHA-256: b90c59e2e59ed32d57ba7cd88e601640c11a938a0af3be07a2d08bc3d24243cf
font_01_sfnt_off0000fc37.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC37 10396 bytes
SHA-256: df0d71647fe4f77d232d04f24652c05661ba31e31b42dffc8ebf3081027bb317

Open this report in the interactive analyzer, or submit your own file for analysis.