Malicious PDF — malware analysis report

Static analysis result for SHA-256 55c7683b533551ce…

MALICIOUS

PDF

82.1 KB Created: 2021-04-11 01:33:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7210535d57619c5281c18d4df8e4e2a1 SHA-1: 515f338b999aae9d62372f956974381db43f49f6 SHA-256: 55c7683b533551ce4a4699bbec0b4b335fb445005244e9200ba1e90fbb752958
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'lozipotod.ru', which is likely the primary distribution point for a malicious payload or phishing page. The document body, though heavily obfuscated, contains references to technical specifications, suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=delta+36-725t2+vs+36-5000t2
    • https://cdn.sqhk.co/pemenodisoda/jorVNjj/word_life_connect_crosswords_puzzle.pdf
    • http://damita.fun/desmos_teacher_training7u8r1.pdf
    • http://copyrighthelp.info/disney_heroes_best_teamnnhip.pdf
    • https://cdn.sqhk.co/rebosuvut/jhcRnto/go_a_long_way_meaning_in_urdu.pdf
    • http://trysoda.club/303210310826n0by.pdf
    • https://cdn.sqhk.co/vogoxaginoje/RbjaOhj/25292109973.pdf
    • http://coupons2020.info/tokyo_ghoul_review_season_2fa88q.pdf
    • https://cdn.sqhk.co/zegareguw/Qjagc2E/real_skate_3d.pdf
    • http://pidawudimo.scienceontheweb.net/college_cookbook.pdf
    • http://copyrightsupportforlnstagram.com/sibapasovonoduxugk97h.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/rujabepifar/tiguzugujikebi.pdf
    • https://s3.amazonaws.com/satedafadusizo/sydney_tv_guide_sunday.pdf
    • http://wififeju.atwebpages.com/how_to_use_safety_1st_humidifier.pdf
    • http://rikutugaxugapib.epizy.com/19432708690.pdf
    • https://s3.amazonaws.com/xiwevitox/creative_envelope_addressing_template.pdf
    • https://s3.amazonaws.com/veraxawewib/how_to_clean_safety_1st_ultrasonic_360_cool_mist_humidifier_blue.pdf
    • http://pisonepegosa.myartsonline.com/52014212613.pdf
    • http://guvodakar.epizy.com/honda_pressure_washer_parts_gcv190.pdf
    • http://pofonuv.epizy.com/wakidobu.pdf
    • https://s3.amazonaws.com/wavunot/pijuvaz.pdf
    • https://s3.amazonaws.com/simujix/titunabememu.pdf
    • https://s3.amazonaws.com/pafiganovavi/how_to_tell_if_your_gas_stove_has_a_pilot_light.pdf
    • http://kesekerezox.epizy.com/projet_aviculture_au_senegal.pdf
    • https://s3.amazonaws.com/jipowumat/59216937170.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eaab.bin
b29f9350a720d2da9dc50567d08c4a82684db1fcb28a47e3a5788345b392d808		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEAAB 6744 bytes
font_01_sfnt_off0000fb90.bin
0ea7546ba1ba39d3db19abb3207c7a53153ec73ac76f5dde2b69d3d55c8130bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFB90 5468 bytes
font_02_sfnt_off00010e56.bin
7231e3a469b1c37c158feba2c4ee32e3fb841558804b8e4e881cf222e4beb844		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E56 13432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.