Malicious PDF — malware analysis report

Static analysis result for SHA-256 52127c46b737184f…

MALICIOUS

PDF

81.6 KB Created: 2021-04-20 02:00:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: baf351b9526d56f2379456f1b220f07b SHA-1: d7b7268ccb8f8c73e41845324ccff1296fac9deb SHA-256: 52127c46b737184f11ac1646ad0b7215efc5a486fe96b3ef27d4ac7e4d0ca613
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely intended to redirect the user to a phishing or malware distribution site. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of the malicious URL strongly suggests a phishing or credential harvesting attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=apple+time+capsule+remove+hard+drive
    • http://kewavixim.22web.org/52300407675.pdf
    • http://lnstagramaccounts.com/518640651261qlw7.pdf
    • http://iclod.tech/what_is_court_of_heavenjin49.pdf
    • http://opt05.ru/jelaziwubazuduzigewaz5omu.pdf
    • http://bio-ita.fun/natagotekorogizimezutmvr9.pdf
    • http://gesojepaxo.22web.org/lowozevolazajukonumopemik.pdf
    • http://kersita.fun/936968206080mbva.pdf
    • http://godisibipuvam.22web.org/introductory_astronomy_and_astrophysics_gregory.pdf
    • http://ar-foto.art/nodomaburikow7flp.pdf
    • http://sbrf.link/emergent_literacy_for_vpk_instructors_answers2nyp3.pdf
    • http://huaweistoreukr.xyz/business_games_pc_free_download8ee6d.pdf
    • http://jobs-ingenieur.best/wesugemonamibujizhywq.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/d4fdc630-1c62-486b-8381-1b6bd6183ac8/dewalt_dw745_best_price.pdf
    • https://uploads.strikinglycdn.com/files/349a0d5f-476d-4a85-9c79-19b274f55024/my_mr_coffee_maker_stopped_working.pdf
    • https://uploads.strikinglycdn.com/files/dc19a92e-19cf-4ca5-98f3-80ed579c6635/kibuletonemojomozo.pdf
    • http://boborema.rf.gd/.pdf
    • http://fikexole.rf.gd/hitchhiker_s_guide_movie_trailer.pdf
    • https://uploads.strikinglycdn.com/files/d0c30175-0bed-4134-a354-a2da91ce4b18/clasificacion_derecho_civil.pdf
    • https://uploads.strikinglycdn.com/files/46a05f2f-24b3-4bd4-b6d2-1d0c93585ab2/why_wont_my_pilot_light_stay_lit_on_my_water_heater.pdf
    • https://uploads.strikinglycdn.com/files/86b617ff-4a8d-4d65-b642-245f35bec9a5/garmin_montana_650_car_mount.pdf
    • http://midelex.epizy.com/apriso_dosage_form.pdf
    • https://uploads.strikinglycdn.com/files/ee9ee94a-2049-4307-879e-6757b6bea4d0/pukuguzevekiviwukujebapo.pdf
    • http://sajavisazoz.epizy.com/mantu_chhuria_new_song_audio.pdf
    • https://uploads.strikinglycdn.com/files/b5a71180-e4ae-43af-9ae6-70f4222376c8/dikarumuvazukelutisekuvob.pdf
    • https://uploads.strikinglycdn.com/files/d16f0e1c-711c-4d15-9db5-fe421ac3be4f/77315261578.pdf
    • http://vixezazemezox.epizy.com/someone_like_you_2001_watch_online.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff1a.bin
d233d40a8c3ea5e06042377da3d03af76eb918ab630d6d78e37c397550c6dd37		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF1A 5364 bytes
font_01_sfnt_off0001112a.bin
636a06af591a02f0960684a6353956d6718ce52a5633ab5fe5959d8dbfd6a4ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1112A 12148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.