Malicious PDF — malware analysis report

Static analysis result for SHA-256 2519b2f69c93a7c8…

MALICIOUS

PDF

80.8 KB Created: 2021-05-28 20:07:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ca0fd4b9ece5e491e4a177932d814d3f SHA-1: 05dd015d007c8328a69ac61631495bec1f440e6c SHA-256: 2519b2f69c93a7c87364680c42f7bc6829ae98776efe7449868226998e1a179d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. It contains an embedded URI pointing to 'https://nipisod.ru/123?utm_term=annexure+3+medical+certificate+of+fitness+form', which is likely intended to deliver a secondary payload or redirect the user to a phishing site. The document body, though heavily obfuscated, suggests a lure related to a 'medical certificate of fitness form'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=annexure+3+medical+certificate+of+fitness+form
    • https://static.s123-cdn-static.com/uploads/4451220/normal_5feb5e8d9c25e.pdf
    • https://static.s123-cdn-static.com/uploads/4380403/normal_60018c127ce4c.pdf
    • https://static.s123-cdn-static.com/uploads/4422367/normal_5ff54162f007e.pdf
    • https://cdn-cms.f-static.net/uploads/4418369/normal_603f63a479f9c.pdf
    • https://cdn-cms.f-static.net/uploads/4366055/normal_5fe8e8baeb9d4.pdf
    • https://static.s123-cdn-static.com/uploads/4369919/normal_60032110d75fa.pdf
    • https://cdn-cms.f-static.net/uploads/4416940/normal_602be745a41f0.pdf
    • https://static.s123-cdn-static-d.com/uploads/4494451/normal_60b047a88f110.pdf
    • https://cdn-cms.f-static.net/uploads/4460230/normal_606e21c27ef6b.pdf
    • https://static.s123-cdn-static.com/uploads/4495551/normal_5ff8be23be91c.pdf
    • https://cdn-cms.f-static.net/uploads/4486523/normal_5fe7739c50285.pdf
    • https://cdn-cms.f-static.net/uploads/4428038/normal_6059a2428ca2a.pdf
    • https://cdn-cms.f-static.net/uploads/4477655/normal_5fd60ec2e4fed.pdf
    • https://cdn-cms.f-static.net/uploads/4417670/normal_606e75b867798.pdf
    • https://static.s123-cdn-static-d.com/uploads/4462688/normal_60affc77ca9b8.pdf
    • https://cdn-cms.f-static.net/uploads/4489440/normal_5fd969ad90aef.pdf
    • https://cdn-cms.f-static.net/uploads/4390051/normal_5fd63a74a0c8b.pdf
    • https://cdn-cms.f-static.net/uploads/4369633/normal_6058ecbd0b005.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e69e9336-2ee5-44bb-9a9f-14c9bc9f5226/what_would_the_rise_of_skywalker_mean.pdf
    • https://uploads.strikinglycdn.com/files/ccbec1bd-5d25-4457-9035-61868d08d86e/31042901667.pdf
    • https://uploads.strikinglycdn.com/files/c237f1f4-f719-4750-8655-38bfe340878d/98337040279.pdf
    • https://uploads.strikinglycdn.com/files/f2ff7f48-d4e6-4582-8fab-be7ebe045498/kenmore_elite_dishwasher_manual_troubleshooting.pdf
    • https://uploads.strikinglycdn.com/files/be688881-bd83-4da7-82ce-f4d0ea9ba590/chinese_grammar_wiki_book.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc57.bin
995c3afa54eeb1f06c307fe9d996ca575fc66afd32ac46e8d46a9e833e1251e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC57 5388 bytes
font_01_sfnt_off00010e9f.bin
f9947fc8e1e53bffd46796ae172801171dc72a2ada5fb79055830e3e6bc26528		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E9F 10968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.