Malicious PDF — malware analysis report

Static analysis result for SHA-256 4254887a810d3d02…

MALICIOUS

PDF

77.2 KB Created: 2021-04-03 15:57:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 577bd07d3cc5c4a3e454c588598bdf69 SHA-1: 9c4014c6a2c6f09c999a27f1a328b8d9e710a115 SHA-256: 4254887a810d3d0251545ee149c87cb8bede684764b9c8aa8733f8e73349af96
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV identifying it as a phishing trojan. The embedded URL `https://nipisod.ru/wix?keyword=fantasy+nails+prices` suggests a phishing attempt disguised as a price list. While no scripts were explicitly extracted, the nature of PDF malware often involves embedded JavaScript to facilitate malicious actions, hence the inclusion of T1059.007.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=fantasy+nails+prices
    • https://cdn.sqhk.co/gunakawujo/fiejgNz/ping_pong_table_3d_model_free.pdf
    • http://bawuselusazemi.iblogger.org/55243027195.pdf
    • http://sportplays.ru/wupexagocb7o2.pdf
    • https://cdn.sqhk.co/lexebogefaj/ggdjd2w/endnote_cite_while_you_write.pdf
    • https://cdn-cms.f-static.net/uploads/4470678/normal_600ce43fee97b.pdf
    • https://static.s123-cdn-static.com/uploads/4392649/normal_5fce84cf140cf.pdf
    • https://cdn.sqhk.co/niserutom/wLiejaT/mavasiwabuwizisoge.pdf
    • https://cdn.sqhk.co/zovogizosute/a9IGffW/38502636496.pdf
    • http://kpovli.ru/adding_2_decimal_places_worksheetopawr.pdf
    • https://cdn-cms.f-static.net/uploads/4443344/normal_603ed51e2d867.pdf
    • http://idealica-italiaufficiale.site/what_is_gods_animal5wlcb.pdf
    • https://cdn.sqhk.co/mitugejaxel/he3GhjO/mystic_diner_restaurant_menu.pdf
    • http://allwoman.site/vusuzuzinevitewovijobaz2h136.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wezukep/37859013193.pdf
    • https://s3.amazonaws.com/wupiwupiwot/kadotipowowujasakoneluzop.pdf
    • https://uploads.strikinglycdn.com/files/b29b62ed-694c-46df-a2b1-9d6c3b4c7bce/wemumuxoxizabab.pdf
    • http://bipunasozusi.epizy.com/journal_of_cellulose.pdf
    • https://uploads.strikinglycdn.com/files/80465b1a-6f5a-40bb-b778-3a2e4c430316/85128496860.pdf
    • http://zagebixomibolo.rf.gd/8792706547.pdf
    • https://uploads.strikinglycdn.com/files/e289cd61-5b9d-4b98-bc2a-3e18baa3cff7/tinemafizusab.pdf
    • http://pasebuda.epizy.com/86411548616.pdf
    • https://uploads.strikinglycdn.com/files/297959a0-3e18-4b2b-add8-a98ddb5923d0/93660697621.pdf
    • https://s3.amazonaws.com/lupuvogotog/xewekavetupukidit.pdf
    • https://uploads.strikinglycdn.com/files/f3cf4792-de36-4ea0-a44e-8051f84e6c72/naredipodoku.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f049.bin
5bc0dd31040cbb13da3242c11f83372d79cad40bb2c2796390e64853f42871cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF049 4984 bytes
font_01_sfnt_off00010158.bin
ebbc48bf3236ecd9c6067702f641aad2e7a3afbfe8e86b4b156d15b61b381846		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10158 11292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.