Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a1305d8bb3b6f9d…

MALICIOUS

PDF

84.4 KB Created: 2021-03-12 03:25:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d92e5fc49ec3e0734d76780ea4e32fef SHA-1: 25fe5e07d360653eba13596a6f88df08b37b5e2d SHA-256: 4a1305d8bb3b6f9db91bf044665bdefda3b23b5fa299055ea9d77fbf2bc50bd6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'lozipotod.ru', which is likely used to host a phishing page or download further malicious content. The document body, though heavily obfuscated, suggests a lure related to a 'webquest answer key', aligning with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=ellis+island+webquest+answer+key
    • https://cdn-cms.f-static.net/uploads/4385436/normal_601469b10c792.pdf
    • https://cdn-cms.f-static.net/uploads/4460476/normal_5fdad4e1a4370.pdf
    • https://cdn-cms.f-static.net/uploads/4483365/normal_60289acf0f572.pdf
    • https://cdn-cms.f-static.net/uploads/4367951/normal_5fda552a96795.pdf
    • http://desajegurake.scienceontheweb.net/nifagubuxopidumobazarorod.pdf
    • https://cdn.sqhk.co/gusisitixinu/gLic7ih/reverso_classic_medium_duetto_price.pdf
    • https://static.s123-cdn-static.com/uploads/4427499/normal_5fef61e0831b8.pdf
    • https://cdn.sqhk.co/rewazexi/PTrijhg/mawazul.pdf
    • http://rotiwopofeze.mywebcommunity.org/design_patterns_explained_simply_java.pdf
    • https://cdn.sqhk.co/ribafesupuro/gjdaifF/95120760225.pdf
    • https://cdn.sqhk.co/zoxowowi/faCQiga/fall_basket_ideas_for_boyfriend.pdf
    • https://cdn.sqhk.co/jupozaregu/Vibhcja/austin_stars_hockey_game_schedule.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/0fe984c4-a671-4b58-b3c8-d45d03484277/msi_z97_pc_mate_motherboard.pdf
    • https://uploads.strikinglycdn.com/files/1a7dbf35-82cc-41ce-a0c2-5dc3dcd68648/nerelekekiteloniguxojux.pdf
    • https://uploads.strikinglycdn.com/files/69acfd01-0afa-4dd8-9650-426a0c2f5f29/navamokerun.pdf
    • https://uploads.strikinglycdn.com/files/82c79d53-1aba-4fc0-afb1-afc395af38e1/57813828623.pdf
    • https://uploads.strikinglycdn.com/files/d64e1ff1-3570-41e9-a9fe-7146c22af7bf/72738808227.pdf
    • https://uploads.strikinglycdn.com/files/8134c29f-625c-4820-9093-96326e4ce940/rerufidorij.pdf
    • https://uploads.strikinglycdn.com/files/d297f0b0-b250-4372-99b4-71b64ccc277f/wonuxe.pdf
    • http://nodikaduf.onlinewebshop.net/89819549193.pdf
    • https://uploads.strikinglycdn.com/files/b551107c-3109-4a71-9975-460aac763f7c/lojidinavulobiguvuna.pdf
    • http://gepivefukusi.atwebpages.com/babette_mangolte.pdf
    • https://uploads.strikinglycdn.com/files/b06c0990-d2c8-456d-bff5-da4c37c4a0a9/yamaha_rx-v863_hdmi_arc.pdf
    • https://uploads.strikinglycdn.com/files/d57ca788-10b7-4e12-8512-199cce6ca14a/mazigarerutuwukedarose.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010e0a.bin
739e3109479bcb630be50f4d8506c2a19043d35ff976cbaec2f4aeab646f575d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E0A 5300 bytes
font_01_sfnt_off00012035.bin
2f7e988143603f23d60937d8bd93b60d6f14034eead5ed3f32688b3b9d3660ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12035 10440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.