Malicious PDF — malware analysis report

Static analysis result for SHA-256 454a5b528304ab17…

MALICIOUS

PDF

119.2 KB Created: 2021-03-06 01:59:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: 32b69e847c553f7a45d965e1de75df0b SHA-1: 5bd78b842f15a05ad0a3660516ba4fe7ea50fbfd SHA-256: 454a5b528304ab1742007cb14da717011e0a2c6f6782936f503aa4de3850ff24
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ML classifiers and ClamAV. It contains an embedded URI pointing to 'https://lozipotod.ru/strik?utm_term=scytek+alarm+wiring+diagram', which is highly suspicious and likely used for phishing or to download a secondary payload. The document body is heavily obfuscated, but the presence of external URIs and the overall detection suggest a malicious intent to redirect users to a compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=scytek+alarm+wiring+diagram PDF link annotation
    • http://ruszaimclub.ru/86918129872stlc9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446379/normal_5ff933fd45b7e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373788/normal_6022be5e6097f.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444123/normal_6008f6c56641a.pdfIn PDF document text
    • http://topvideo.design/the_alienist_downloadilp2u.pdfIn PDF document text
    • http://sellforce.ru/98144704869g5pzf.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4464068/normal_5fdb7bdd5c61f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8bf350ce-22b9-4a3e-8d31-2d161bcca24b/past_simple_regular_and_irregular_verb_exercises.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa093cb7-5363-4dec-87b4-78c90d84dbad/70974580257.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c31352f3-ac10-4d54-b360-052b8d2466a6/everstart_maxx_battery_charger_review.pdfIn PDF document text
    • https://s3.amazonaws.com/loranoduzuja/what_is_another_name_for_nerve_cells.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c2e3341e-bcbd-4931-9b20-c850a45074a6/combining_like_terms_and_distributing_practice_answer_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/80859bb7-39a0-450b-8d57-6e9c0ede1255/80215148797.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f92a7ab-9d5c-41f9-915b-5e8efb955183/bexadi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b0762dfd-190a-48d8-828e-b049b39d4a7e/spongebob_kills_mr_krabs_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a721f97b-6031-4968-b17e-b63f8278bc63/what_is_francois_philosophy_of_leadership.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/336d0c83-aefb-482a-930b-c4e33697f2fe/quran_arabic_and_english_translation.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d10b4324-fa81-4c5a-a448-2cbd8a64c05f/73141572533.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2c1cb695-bee1-46d5-9e58-2c142e00aa7d/what_does_developmental_milestones_mean_in_spanish.pdfIn PDF document text
    • https://s3.amazonaws.com/dovulavavo/fotewotanebezosageg.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00019638.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19638 5444 bytes
SHA-256: 0003fdefe04f8bf9245dd009166ce4b5ad7f5c2d5b230fdc0e929d74faa4d19a
font_01_sfnt_off0001a8c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A8C5 11432 bytes
SHA-256: 9a603cc4ac07a78e0458fad7cd92a955faec6fb3b7739858b27346c60666f5c9

Open this report in the interactive analyzer, or submit your own file for analysis.