Malicious PDF — malware analysis report

Static analysis result for SHA-256 518afd598ac5144e…

MALICIOUS

PDF

93.3 KB Created: 2021-03-23 10:26:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4fcc16b9233a99087428552b39b2d38d SHA-1: d33f9cfefe34b9419abf9453b4d7b093c4e2d28d SHA-256: 518afd598ac5144ed2eddd4a52d4cbe1b0cb639c7f9e9f5f97428511760c30d2
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ClamAV and an ML classifier, with heuristics indicating the presence of external URIs. The embedded URL `https://nipisod.ru/award?keyword=boy+meets+girl+meg+cabot+pdf+download` suggests a lure to download content, likely leading to a phishing or malware distribution site. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=boy+meets+girl+meg+cabot+pdf+download
    • http://pivojowemetobiv.mywebcommunity.org/pezeronurirekozumix.pdf
    • https://cdn.sqhk.co/gazegarov/egfggjd/exoplanet_definition_example.pdf
    • http://comp-arenda.site/luxabimasonejopakelisimodice9a.pdf
    • http://shoop-ft.ru/611234718717h4id.pdf
    • http://instacopyrightcenter.com/71860199448qky7q.pdf
    • http://batmbatm.ru/what_do_stock_market_symbols_meanle49h.pdf
    • https://cdn.sqhk.co/zumufapofow/dv4VJic/i_don_t_know_cartoon_characters.pdf
    • http://mmuuue.space/cash_for_visa_gift_cards_near_me2mfk3.pdf
    • https://cdn-cms.f-static.net/uploads/4455673/normal_6038ea3f74f39.pdf
    • https://cdn.sqhk.co/puxolika/jf4Qhhg/18246312147.pdf
    • http://pemufosapakem.mypressonline.com/33594095312.pdf
    • http://lejidakoxinetog.mywebcommunity.org/53291759970.pdf
    • https://cdn-cms.f-static.net/uploads/4459645/normal_601f9b2c8735a.pdf
    • https://cdn-cms.f-static.net/uploads/4500200/normal_5fdbfccccf64c.pdf
    • https://cdn-cms.f-static.net/uploads/4462726/normal_602101f386dcb.pdf
    • https://static.s123-cdn-static.com/uploads/4501975/normal_5ff78155eca2f.pdf
    • https://cdn.sqhk.co/pibepufas/jeiiii1/4627486930.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/gedesisumi/ruxewuximulibavowesawasus.pdf
    • https://uploads.strikinglycdn.com/files/64d799ee-544c-4dfe-a847-ca82dcc2bc5c/81250581630.pdf
    • https://uploads.strikinglycdn.com/files/6f1e183d-d927-4e4e-af07-0cba3e7a7c92/alpha_omega_elite_car_seat_weight_limit.pdf
    • https://uploads.strikinglycdn.com/files/034076ab-4156-46cf-b4a6-cbe44604d509/how_to_set_my_atomic_clock.pdf
    • https://uploads.strikinglycdn.com/files/255aabc4-628e-4a75-bf4f-c687e158865f/fender_mustang_1_20_watt.pdf
    • https://s3.amazonaws.com/sazomo/guided_reading_year_1_texts.pdf
    • https://s3.amazonaws.com/mubefula/bapuxotejabaroxezoga.pdf
    • https://uploads.strikinglycdn.com/files/b8e1591c-2e17-44e2-9ecf-3df3ea4e92fb/49145267980.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012caa.bin
ef94787ee0f5b9fab67ff62e1e253f5ba2001e451465aadc53797e4087dd9224		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CAA 5856 bytes
font_01_sfnt_off000140a0.bin
ef5132dcfcf481abaed42460a6cdaa198f9ad2882d063e9eabd8b110d9a20018		 pdf-font-stream PDF embedded font (sfnt) at offset 0x140A0 11212 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.