Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a25d33474419df7…

MALICIOUS

PDF

221.2 KB Created: 2021-03-13 23:27:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 01f3fc8577f9bd3cb9512d0d9b3f7432 SHA-1: b30d0fba83405e23b3888dee5aa249438ddf39ae SHA-256: 3a25d33474419df7ad9e3257aa1eea20243fd13bb990f304e9194b46b9d24bf8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by a ClamAV signature and an ML classifier, indicating a high likelihood of malicious intent. The presence of an external URI pointing to 'nipisod.ru' suggests the document is designed to redirect users to a potentially harmful website. Although no scripts were explicitly extracted, the PDF structure and the embedded URI are strong indicators of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=hajj+and+umrah+guide+hanafi
    • https://cdn-cms.f-static.net/uploads/4465400/normal_5fe902fbc85b7.pdf
    • http://dariduv.22web.org/zegedaninilomewobaw.pdf
    • http://tacfitproducts.com/92826520485uhw8c.pdf
    • http://vawafaxas.iblogger.org/knowledge_acquisition_in_artificial_intelligence.pdf
    • https://cdn-cms.f-static.net/uploads/4478685/normal_5fdab299dc44e.pdf
    • http://servicesforsupport.com/what_reading_level_are_the_goosebumps_booksej6oe.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tadevewuju/aadhar_card_copy_by_name.pdf
    • https://uploads.strikinglycdn.com/files/de6a72b4-5143-4409-af25-efbe05160d60/romeo_and_juliet_1996_full_movie_download_with_subtitles.pdf
    • https://uploads.strikinglycdn.com/files/8b65f2e0-687b-40d8-9e60-2057454d6937/97352405331.pdf
    • http://putiweg.epizy.com/91306893663.pdf
    • https://s3.amazonaws.com/jidosatikim/instagram_apk_followers.pdf
    • https://uploads.strikinglycdn.com/files/599181f7-4b59-483a-bbbc-bda1f76762fb/ozymandias_poem_analysis.pdf
    • http://vukunazovi.rf.gd/kijonagaluwupojum.pdf
    • https://s3.amazonaws.com/bizamesuwepe/escape_room_answers_level_113.pdf
    • https://s3.amazonaws.com/tejuvonixag/61649536481.pdf
    • http://namutogenasokab.epizy.com/36368284111.pdf
    • https://uploads.strikinglycdn.com/files/7c22691f-2b00-4098-87e5-24851e9f0330/rascal_scooter_not_charging.pdf
    • https://s3.amazonaws.com/ronenitevodo/whatsapp_plus_2019_atualizado_uptodown.pdf
    • https://s3.amazonaws.com/pesetufavo/najobuwokip.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00032ab1.bin
7c57fed3297a9e4b5383e44040954150faad3a389f421dcf0db92b2bf8dcea5c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x32AB1 34064 bytes
font_00_sfnt_off0002f207.bin
5a01dc6a88c92222379a24766fe4c9198391540459c1a74905dba9d702bd08fb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F207 5148 bytes
font_01_sfnt_off00030367.bin
2a345986947e530438a9b2908435b3939710179d1d59a0e5debe56b17562b462		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30367 11656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.