Malicious PDF — malware analysis report

Static analysis result for SHA-256 60ade3dc8c1ca89d…

MALICIOUS

PDF

94.4 KB Created: 2021-04-07 06:47:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f0815f666bb19055a5bdbdb1e3b7c4fb SHA-1: 44e3a0a4f772cae2f760bf00919e085e336518e5 SHA-256: 60ade3dc8c1ca89d9ab79258a2403f20e54eaa8ec2b969b2d0d27a9560137774
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing or trojan. It contains an embedded URI pointing to 'nipisod.ru', which is likely the malicious destination. The document body, though heavily obfuscated, contains keywords related to business plans, suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=bookkeeping+service+business+plan+pdf
    • https://cdn-cms.f-static.net/uploads/4530712/normal_60593b9dd9598.pdf
    • https://cdn-cms.f-static.net/uploads/4411498/normal_603c2175832a8.pdf
    • https://cdn.sqhk.co/jewezaledev/LuhatcV/c3_test_1_listening_answers.pdf
    • https://cdn.sqhk.co/jetuzama/UhhThdl/free_award_certificate.pdf
    • https://cdn.sqhk.co/wojipezusax/iBMtjaQ/kuwov.pdf
    • https://cdn.sqhk.co/vofonowul/ibhgKgj/98360470178.pdf
    • https://cdn.sqhk.co/galemojubemo/I2ie4ji/92274152973.pdf
    • https://static.s123-cdn-static.com/uploads/4369165/normal_5fe4e20517a18.pdf
    • https://cdn.sqhk.co/temegolu/jeVjg4j/ropuru.pdf
    • https://cdn.sqhk.co/veludewozen/jeTXi5W/baseruxilisazu.pdf
    • https://static.s123-cdn-static.com/uploads/4471711/normal_5ff05e9b15545.pdf
    • https://cdn.sqhk.co/vafodagusun/ujjhiU8/wedanexikupukozuzen.pdf
    • https://cdn-cms.f-static.net/uploads/4480750/normal_606bfbd5389fb.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1dd35793-9ec8-4570-9a9d-b116cc432a9c/yvain_the_knight_of_the_lion_summary.pdf
    • http://wotawegij.rf.gd/tidufikurafado.pdf
    • http://ripomozenawigi.rf.gd/checkpoint_5100_datasheet.pdf
    • http://kuwixogup.rf.gd/65_bpsc_question_paper_2019.pdf
    • https://uploads.strikinglycdn.com/files/7be533ee-865a-4438-a75b-d9bd15fd55bf/how_much_is_a_sony_bravia_42_inch_tv.pdf
    • http://gikuzeviseg.rf.gd/annadata_bengali_movie_songs.pdf
    • https://uploads.strikinglycdn.com/files/871bf65d-92d9-4763-b89e-889b6fc50e04/parofaged.pdf
    • http://piwukoge.rf.gd/sigodikevifofuvab.pdf
    • http://nejukiwipe.rf.gd/setup_suddenlink_remote_control.pdf
    • https://uploads.strikinglycdn.com/files/dfc7eff7-8749-4402-a303-ad6311bf39c4/what_political_is_canada.pdf
    • http://noxawobamuxila.epizy.com/how_to_flush_a_rinnai_r94ls.pdf
    • https://uploads.strikinglycdn.com/files/44e892da-a5d7-4957-bbde-b5642df6b0e4/arduino_uno_r3_datasheet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00013404.bin
1c454085db7beb1781f4bd3d1a94dc7c7fd242be72453dfe25e81fea876660d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13404 5636 bytes
font_01_sfnt_off0001474f.bin
9c3e48292f6f615460ab1d3284956a50a3f44391c40db2d89bbc22a7d10f56d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1474F 10756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.