Malicious PDF — malware analysis report

Static analysis result for SHA-256 604c4c4b08ee1380…

MALICIOUS

PDF

85.9 KB Created: 2021-05-21 20:27:33 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 12c1c9f6695a7b052709da5635c3538f SHA-1: 45e084ceb5220b46d811cd1d732fc7b6bf2a96c8 SHA-256: 604c4c4b08ee13809fc790aaed73397cc3a62ed9202fd08d5893a508bc48329f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'lozipotod.ru', which is likely used to redirect the user to a phishing or malware distribution site. The document body, though partially corrupted, suggests a lure related to a popular product, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wb?keyword=how%20to%20put%20stickers%20on%20yeti%20cup
    • https://cdn-cms.f-static.net/uploads/4421213/normal_603e633875e24.pdf
    • https://cdn-cms.f-static.net/uploads/4403413/normal_602d2b227a599.pdf
    • https://static.s123-cdn-static.com/uploads/4367940/normal_5ff9348474be6.pdf
    • https://cdn-cms.f-static.net/uploads/4446264/normal_6025cab133915.pdf
    • https://static.s123-cdn-static.com/uploads/4469378/normal_5ffe95aaafc5a.pdf
    • https://static.s123-cdn-static.com/uploads/4489850/normal_5ff0898f939e5.pdf
    • https://cdn-cms.f-static.net/uploads/4426815/normal_601d29dfe9e9c.pdf
    • https://static.s123-cdn-static.com/uploads/4474988/normal_5fff97215539a.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/3d870ec3-1797-4749-a9bc-dd85fc1a0ed7/niviwetikixuvawazo.pdf
    • https://uploads.strikinglycdn.com/files/e7292231-1961-4c35-a430-488323c51121/76555064120.pdf
    • https://s3.amazonaws.com/timeziso/19991718023.pdf
    • https://uploads.strikinglycdn.com/files/76819750-b35a-40d4-a167-103d39a87a1e/8480948136.pdf
    • https://uploads.strikinglycdn.com/files/489b9dd4-2ec8-4a36-8b10-008bea994306/the_gospel_of_judas.pdf
    • https://uploads.strikinglycdn.com/files/92426bf2-31c3-4355-ab26-1423b6eff6e0/best_basic_accounting_books_for_beginners.pdf
    • https://uploads.strikinglycdn.com/files/5f909789-f12a-4cf7-8506-9654803873f3/61551790910.pdf
    • https://s3.amazonaws.com/fejififimaketo/50354913319.pdf
    • https://s3.amazonaws.com/falufusu/corel_draw_x5_shortcut_keys_list.pdf
    • https://s3.amazonaws.com/lazesej/catriona_gray_answer_104_million.pdf
    • https://uploads.strikinglycdn.com/files/e88b0ceb-dc9c-45f4-9520-3dcc58dd75ad/robin_williams_intelligent_design_youtube.pdf
    • https://uploads.strikinglycdn.com/files/6ae2de44-f9b7-4967-b6ad-57c0141305f9/36199666021.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0a6.bin
62ef3e882a9aaa8db0daf44a7e1b27e76ea012933dd27f577809dd17c6c736b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0A6 4904 bytes
font_01_sfnt_off0001017a.bin
7b4739545c822e97f17d519fbde88091841b6660700663f52d82222b69de7c2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1017A 4056 bytes
font_02_sfnt_off00010ca5.bin
f8e0a03f854264dce6b986f62f552c42319f206be60a68dc1096a4db33677683		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10CA5 11684 bytes
font_03_sfnt_off000134af.bin
676a6f9980301d650ad9b511319da6dac9fff4f77c228169d287e5253a078183		 pdf-font-stream PDF embedded font (sfnt) at offset 0x134AF 16148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.