Malicious PDF — malware analysis report

Static analysis result for SHA-256 476ab7f260ab34b6…

MALICIOUS

PDF

83.9 KB Created: 2021-03-17 02:15:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2337e6a460bd57ce733926a4bf228436 SHA-1: dad60d47052766399338bfc113b032ff039a1f27 SHA-256: 476ab7f260ab34b63a88a5272b747e01d02c63a884280161a8cc72ba13e302ba
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'nipisod.ru', which is likely part of a phishing or malware distribution scheme. The document body, though partially obfuscated, references 'Craftsman 33 gallon air compressor parts', suggesting a lure to attract victims interested in such products.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=craftsman+33+gallon+air+compressor+parts
    • http://dipazekonowa.mypressonline.com/998486378.pdf
    • https://static.s123-cdn-static.com/uploads/4462345/normal_5ff183db128b1.pdf
    • http://debikina.22web.org/comparative_administrative_law.pdf
    • http://dotavulilego.mypressonline.com/49989435873.pdf
    • https://static.s123-cdn-static.com/uploads/4421767/normal_5fec9186531ac.pdf
    • https://static.s123-cdn-static.com/uploads/4380869/normal_5ff0bb7dc1c85.pdf
    • https://cdn-cms.f-static.net/uploads/4488804/normal_604cba5742567.pdf
    • https://cdn-cms.f-static.net/uploads/4428342/normal_5fe6cf51ecb53.pdf
    • https://cdn-cms.f-static.net/uploads/4527108/normal_601156194fb5c.pdf
    • http://zonizubiro.getenjoyment.net/gegatisejegeragoku.pdf
    • http://ziwewixowele.sportsontheweb.net/mulit.pdf
    • https://cdn-cms.f-static.net/uploads/4468827/normal_5fd3b3dc7e0f8.pdf
    • https://static.s123-cdn-static.com/uploads/4470523/normal_5fc8fd21b40e5.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://nowimirozox.atwebpages.com/13501366306.pdf
    • https://981168d4-05fc-44b6-871d-73371d7e8cf1.filesusr.com/ugd/87d215_5be1f0458de847148565551de17dd713.pdf?index=true
    • https://7737876a-f762-42ef-af6f-18b78abacabf.filesusr.com/ugd/9066bd_a1a07026b6af404b86e1e0c00e9128da.pdf?index=true
    • http://robinovedibepo.epizy.com/30224167567.pdf
    • http://jofisakukobi.rf.gd/63702038556.pdf
    • https://s3.amazonaws.com/kiremefegonar/negixadigegeruzi.pdf
    • https://s3.amazonaws.com/wupagivoz/microsoft._net_framework_version_4._6._2.pdf
    • https://s3.amazonaws.com/zodawanuror/xivefamadepaj.pdf
    • https://s3.amazonaws.com/pafiganovavi/zufudokojij.pdf
    • https://6afed14e-2b01-442b-8c2e-11a8a6f39965.filesusr.com/ugd/46a5ae_d5f22591f4c944b2bfe5f88ae8b9810d.pdf?index=true
    • http://gipuzasidu.rf.gd/libro_estadistica_descriptiva_levine.pdf
    • https://s3.amazonaws.com/gewisetug/mizaxukofovigopagenisi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000106f5.bin
239998b0b118a82e85f9bcd0c07e8d21973f1d29cbf886f9aecc03862cb25c19		 pdf-font-stream PDF embedded font (sfnt) at offset 0x106F5 5404 bytes
font_01_sfnt_off00011941.bin
dc64310c334090f677e604fd3adc042deb055544c94234675356da2bf5e4a95b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11941 11916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.