Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d94ec151d1d9ce8…

MALICIOUS

PDF

69.1 KB Created: 2021-05-19 03:02:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1268371d4022f665df8a278caf32e615 SHA-1: 653d88070ec6fe7ab243238763802b566367f415 SHA-256: 5d94ec151d1d9ce8bfba848c3a901963259d624da46f99ee502b09af8631a4a5
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document body, though heavily obfuscated, contains references to 'Monster Hunter World' and a URL that redirects to 'lozipotod.ru'. This suggests a phishing or malware distribution lure, likely using the game guide as a pretext to entice clicks on the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/strik?utm_term=monster+hunter+world+longsword+guide+reddit
    • https://cdn-cms.f-static.net/uploads/4474987/normal_6030e8549f4f5.pdf
    • https://static.s123-cdn-static.com/uploads/4383804/normal_600922c985c0d.pdf
    • https://cdn-cms.f-static.net/uploads/4453914/normal_60567ca17fa45.pdf
    • https://cdn-cms.f-static.net/uploads/4454168/normal_6044d07e55fdb.pdf
    • https://static.s123-cdn-static.com/uploads/4444351/normal_5fcd98e2c9acc.pdf
    • https://cdn-cms.f-static.net/uploads/4470027/normal_6029832ee8351.pdf
    • https://cdn-cms.f-static.net/uploads/4458616/normal_606035fe18a44.pdf
    • https://static.s123-cdn-static.com/uploads/4452595/normal_5fd07f9252d63.pdf
    • https://static.s123-cdn-static.com/uploads/4424025/normal_5ff861703a716.pdf
    • https://cdn-cms.f-static.net/uploads/4368977/normal_60599ce321ee3.pdf
    • https://cdn-cms.f-static.net/uploads/4409107/normal_606450326929f.pdf
    • https://cdn-cms.f-static.net/uploads/4449615/normal_6012627048551.pdf
    • https://cdn-cms.f-static.net/uploads/4426085/normal_5fdbf7b0b9e77.pdf
    • https://cdn-cms.f-static.net/uploads/4467561/normal_601a41e9493a7.pdf
    • https://cdn-cms.f-static.net/uploads/4393762/normal_603f4d7c80beb.pdf
    • https://static.s123-cdn-static.com/uploads/4443356/normal_5fcb14227ebc7.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/c0ac3d89-9f09-46e1-aad3-d5ee18169c5d/is_arnold_schwarzenegger_vegan.pdf
    • https://uploads.strikinglycdn.com/files/de268259-071c-4ed8-bf3f-69c84c6776f2/70060954999.pdf
    • https://uploads.strikinglycdn.com/files/7a3b32a5-1ce9-43be-b785-326009339bce/58219977127.pdf
    • https://uploads.strikinglycdn.com/files/45678d96-601f-4eb0-b41f-3c8c0c1016f3/71857423534.pdf
    • https://uploads.strikinglycdn.com/files/5a49f8bd-53f2-4cff-b143-6558064a550f/get_codes_check_engine_light.pdf
    • https://uploads.strikinglycdn.com/files/381176bb-815d-4a3c-bc2c-f22e998e8bb6/xojel.pdf
    • https://uploads.strikinglycdn.com/files/4bad90a4-03f8-4115-b65e-bb3039ec4a4b/nazekabi.pdf
    • https://uploads.strikinglycdn.com/files/657691c0-574c-474f-ab0e-20b7dfb44223/lumir.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d434.bin
1f929855fab9d7a2a3d54c1384127c73be547d714d897728d594f236bd07d957		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD434 4972 bytes
font_01_sfnt_off0000e531.bin
861be9e04816a6724b034535d7a74a452910b6bb1c3ec9a19e608145f7247359		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE531 9832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.