Malicious PDF — malware analysis report

Static analysis result for SHA-256 2929a4320820eb8b…

MALICIOUS

PDF

78.0 KB Created: 2021-03-20 09:44:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 72bb1726fa04a02bc3dce7f4ed20197f SHA-1: d267026eb7803c328de2b73065626150875f1803 SHA-256: 2929a4320820eb8bca7b811805f955339c68b81e5d203b798b03ea36c26bf337
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an external URI pointing to 'lozipotod.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a deceptive title intended to trick the user into interacting with the embedded link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=correct+the+grammar+mistake+in+each+sentence
    • http://subbellassecret.com/linux_system_programming_tutorial_pointropjy.pdf
    • http://redirunna.xyz/febonowizfgh3r.pdf
    • http://eeuuurrrrr.space/are_green_potatoes_ok_to_eat_australiag2bje.pdf
    • http://hempmap.ru/are_lg_sound_bars_any_goodje1ks.pdf
    • http://de-bewertung-889562.icu/deripidak9xq.pdf
    • http://giveaway2020.info/side_by_side_english_book_free_downloaduh13x.pdf
    • http://reduslimitalia.site/funny_movies_guys_likewyayu.pdf
    • http://milansit.space/lijokifivopuzipunasinabopzhlkz.pdf
    • http://jiwafuwik.22web.org/capelania_hospitalar.pdf
    • http://creditreportfast.info/dark_souls_2_fun_weapons_pvec9i9s.pdf
    • http://esportzmlevent.com/fire_safety_plan_for_construction_sites613cy.pdf
    • http://sewowenokep.iblogger.org/85203949330.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/88021f57-6091-4908-a708-788bbd030f0c/how_to_get_panasonic_inverter_microwave_out_of_demo_mode.pdf
    • https://s3.amazonaws.com/bisapovepizaj/65587818248.pdf
    • https://s3.amazonaws.com/fowonaxul/swift_numberformatter_style.pdf
    • https://s3.amazonaws.com/wudibirewuduto/wasivaru.pdf
    • http://koxogulu.rf.gd/jineruxi.pdf
    • https://uploads.strikinglycdn.com/files/eb211470-6394-49f4-8b96-87ea34f745c7/aws_architecture_drawing_tools_online.pdf
    • https://uploads.strikinglycdn.com/files/266cd1b5-b8b8-4fb0-90e1-4351fcf6e85d/lugabigapokivim.pdf
    • https://s3.amazonaws.com/sefukirexuwekij/tewilesexokusoj.pdf
    • https://s3.amazonaws.com/pusolefosex/soil_mechanics_laboratory_manual_9th_edition_free.pdf
    • http://zelonixen.epizy.com/digital_marketing_executive_jobs_for_freshers.pdf
    • https://s3.amazonaws.com/tezude/sigawudakebilo.pdf
    • https://uploads.strikinglycdn.com/files/45a57bb3-bcc6-42cf-b2f7-b504c6981c26/elementary_statistics_triola_12th_edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ebe9.bin
4b83d5989b5e0a249bed5aad3df69432a5b0b13f4c56b225920d428b9967605b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEBE9 5148 bytes
font_01_sfnt_off0000fd43.bin
9bcbd94b1812f5a0c42cbacb9b1f5161548e9d8c2cc75098c7a6655e715acf42		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD43 13552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.