Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e5612e9672bd2c5…

MALICIOUS

PDF

90.6 KB Created: 2021-03-17 22:24:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-07
MD5: 5b02716ab4ac5ce3b8b06ba2de8a6a9b SHA-1: 5f58742acefe36765bc9a4a1536895733c64cfd2 SHA-256: 3e5612e9672bd2c58f49711604ef0909c3c4bf8ccb58add7ed7cbb7c85abf555
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical ClamAV detection and an ML classifier, indicating malicious intent. The document body, though heavily obfuscated, contains text related to a medical guide search query, which is likely a lure. Several embedded URLs point to external domains, with one notable URL being https://nipisod.ru/award?keyword=sanford+guide+to+antimicrobial+therapy+2020+pdf, suggesting a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=sanford+guide+to+antimicrobial+therapy+2020+pdf PDF link annotation
    • http://sagedix.medianewsonline.com/who_is_doing_free_covid_testing_near_me.pdfIn PDF document text
    • https://cdn.sqhk.co/zogowefu/ciiahiX/check_license_plate_number_canada.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4462056/normal_5fe35a2724de9.pdfIn PDF document text
    • http://reduslim-europa.site/chamatkar_full_movie_dailymotionu2hne.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454047/normal_6037d8db3cbe4.pdfIn PDF document text
    • http://50offshop.info/rangers_of_oblivion_wikipediaemph9.pdfIn PDF document text
    • http://funasowuto.getenjoyment.net/76255355979.pdfIn PDF document text
    • http://nesobaka7.xyz/195069419183s1o7.pdfIn PDF document text
    • http://cabinetshub.xyz/bitdefender_total_security_setupjqdl8.pdfIn PDF document text
    • http://bopugafuwu.scienceontheweb.net/cooks_essential_pressure_cooker_recipes.pdfIn PDF document text
    • http://gadatoreneperil.mygamesonline.org/how_do_i_activate_call_waiting_on_my_panasonic_cordless_phone.pdfIn PDF document text
    • http://hot-money.fun/amplificador_qsc_rmx_1450_precionuv6u.pdfIn PDF document text
    • https://cdn.sqhk.co/pesegozod/owZIEqr/51028739126.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://s3.amazonaws.com/kotenu/charlie_full_malayalam_movie_in_tamilrockers.pdfIn PDF document text
    • http://pezamax.myartsonline.com/nutrition_facts_dunkin_donuts_reduced_fat_blueberry_muffin.pdfIn PDF document text
    • https://s3.amazonaws.com/figugipopar/nupuguwebizigudepuvuxa.pdfIn PDF document text
    • https://s3.amazonaws.com/mexijegedakol/22934135734.pdfIn PDF document text
    • https://s3.amazonaws.com/tazopaju/powasopoxokadebukisa.pdfIn PDF document text
    • https://s3.amazonaws.com/tedowafomaru/83304668429.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxalowafokuvo/72187688062.pdfIn PDF document text
    • https://s3.amazonaws.com/babuxufarizuxur/street_fighter_3rd_strike_chd.pdfIn PDF document text
    • https://s3.amazonaws.com/meludav/1336846998.pdfIn PDF document text
    • https://s3.amazonaws.com/vunizi/60124058445.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e04d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE04D 6012 bytes
SHA-256: 342d3b9cff55411643c96fd752245e61b1e5727bbb21a47c84d04bc4a86aefe4
font_01_sfnt_off0000f496.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF496 11284 bytes
SHA-256: 52e01b7208681c34d896768c6ae2a9ac4ed72a8c500ec73faa181d32044a1064
font_02_sfnt_off0001143e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1143E 2396 bytes
SHA-256: d1a878327e9a770b4fda4f9d38c24ee8e86a9577954d69df787606b2fccb8249
font_03_sfnt_off00011f34.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F34 11612 bytes
SHA-256: c5971f357a609a392a0739536ea2ac1feae6c236ed6dffb77a2c8c3a35b38cb9
font_04_sfnt_off000145e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x145E6 16216 bytes
SHA-256: e2e3d1051de8ddbff4c5403344dce7147ee707e0457668c585c9d9eaba6b6284

Open this report in the interactive analyzer, or submit your own file for analysis.