Malicious PDF — malware analysis report

Static analysis result for SHA-256 51830a94de602770…

MALICIOUS

PDF

79.9 KB Created: 2021-02-28 00:07:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-20
MD5: 04f13aa5f816eb9c41a5e086ff551f9a SHA-1: 5bb3599492ce74058d41b15fcc54d64f10aa1469 SHA-256: 51830a94de602770179bd06ca704ec33f4a2acad90af8ecb8e7c1a142e23c68f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains an embedded URL, 'https://nipisod.ru/aws?utm_term=is+there+a+grace+period+for+nc+drivers+license+renewal', which is likely used to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a lure related to driver's license renewal, a common phishing tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/aws?utm_term=is+there+a+grace+period+for+nc+drivers+license+renewal PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4421466/normal_5fd671f333162.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4393890/normal_5fdc0f7740f1b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4494430/normal_5fceef27af22c.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4382961/normal_5fed4ce55a066.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4412173/normal_5ff7ff3d36fe6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4530171/normal_600696d8f0052.pdfIn PDF document text
    • https://cdn.sqhk.co/tajugajobib/deiJ3ic/bo4_zombies_leveling_system.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4456687/normal_600e438c4f911.pdfIn PDF document text
    • https://cdn.sqhk.co/gawivoxolo/JijkJha/fofomej.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403936/normal_602690658a3c8.pdfIn PDF document text
    • https://cdn.sqhk.co/xejudawadoni/ihLhasA/champions_centre_bellevue_wa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385198/normal_6027e59b3a219.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471234/normal_60324c9d10ba1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4369908/normal_5ff30d578c923.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4495265/normal_60174168a39f0.pdfIn PDF document text
    • https://cdn.sqhk.co/lakuziwi/BtqgggQ/school_of_dragons_wiki_codes.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jedobufudajewu/9471141185.pdfIn PDF document text
    • https://s3.amazonaws.com/degisapemifa/bitdefender_antivirus_2018_free.pdfIn PDF document text
    • https://s3.amazonaws.com/rebesudanolo/what_was_the_news_all_about_coronavirus.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa92.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA92 5508 bytes
SHA-256: 2d2b1dac493b30ff80d1843aca78b2ea45fa7706e18f13dcb1392345248eba73
font_01_sfnt_off00010d62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D62 10852 bytes
SHA-256: 9792d93b77e41d8e5e365756de27d3a485b5fb7c5a264239e3e48ddaef72d9de

Open this report in the interactive analyzer, or submit your own file for analysis.