Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e14aa26e655c990…

MALICIOUS

PDF

81.0 KB Created: 2021-04-14 00:57:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cc1d0fa9f3c7055d84cf1d9e5d78b159 SHA-1: 1919af810c282e6bc81349af3c78ff36bd123e30 SHA-256: 2e14aa26e655c990d89e40ef79a5bfe0a6bdd5ed1af28082a226b8507fafb96a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://nipisod.ru/strik?utm_term=egalitarian+vs+hierarchical', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to 'Egalitarian vs hierarchical'. No scripts were extracted, but the presence of external URIs and the overall malicious verdict strongly suggest a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=egalitarian+vs+hierarchical
    • http://japancar-sib.ru/everybody_hates_chris_online_season0z0q7.pdf
    • http://kipeliri.22web.org/verbo_haber_conjugacion.pdf
    • http://lynciguest.com/freely_freely_you_have_received_sheet_musicztsds.pdf
    • http://iranomics.com/tazafejudeweriqqsdz.pdf
    • http://sparzha.club/cat_s_cradle_novelcwgph.pdf
    • http://e-devletturkiyeaidatsistemimgovtr.com/what_stretches_to_do_before_lifting_weightsto2fa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/29c9c263-4ce6-4922-926c-3e6dd2521801/what_is_in_boston_market_creamed_spinach.pdf
    • https://uploads.strikinglycdn.com/files/770813ad-b447-4def-8287-7b7957d91b79/how_to_use_ergo_carrier_with_infant_insert.pdf
    • https://uploads.strikinglycdn.com/files/241bf4c8-3361-4381-9af8-46f14301e1e2/gosirugadozetevigosoxikip.pdf
    • https://uploads.strikinglycdn.com/files/aa22f412-a93f-4bc1-b450-04c3ad0fb2e5/bejimujolovidipoli.pdf
    • https://s3.amazonaws.com/tawosutosuxi/74313161795.pdf
    • https://uploads.strikinglycdn.com/files/c6ee2599-6a38-4fc4-aa4d-06d991f67c9e/bowflex_xtl_review.pdf
    • https://uploads.strikinglycdn.com/files/95bcecb1-46df-4ab5-a69c-ec886f2ed07e/the_stranger_albert_camus_criticism.pdf
    • http://didoruvevesipug.rf.gd/quotes_from_the_selection_series_with_page_numbers.pdf
    • http://dovesibikore.epizy.com/36639909642.pdf
    • https://uploads.strikinglycdn.com/files/bc446433-d611-4590-a03d-50d7a845aee6/jay_z_in_the_dust_of_this_planet_t_shirt.pdf
    • https://uploads.strikinglycdn.com/files/f93bd5a6-34b9-4a1f-b403-99e8c7550a1c/pretty_little_liars_season_1_cast_alex.pdf
    • https://s3.amazonaws.com/bitajemisajoz/siluje.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f6ea.bin
e88f9196ed5090aa90056a1d8f4c28b9dc4126727920fb96cdbc329041dec0c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6EA 5080 bytes
font_01_sfnt_off00010839.bin
51ebeec29509b87aa858d500e37ac8853184703d07d1f913ce36d8e1dc7764c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10839 1800 bytes
font_02_sfnt_off000110c7.bin
416b9133fac6317be3077f47c98bc7b00707a1006ac3b1b93ba7b4e43afe3cb9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110C7 10532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.