Malicious PDF — malware analysis report

Static analysis result for SHA-256 69069049f815142b…

MALICIOUS

PDF

74.2 KB Created: 2021-06-08 15:01:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 659dec205f562d5de58fc8141f6955c7 SHA-1: c470f0039b0ee6b027cc4c50add6a8e23aa2e368 SHA-256: 69069049f815142b3d5bee7b726a6a790a17d49cc655e2dfb9b91d851ec8da8a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The document contains an embedded URI pointing to 'pistant.ru', which is presented as a link for downloading Bollywood movies, a common social engineering tactic. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest it's designed to redirect users to a malicious site, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pistant.ru/pbw?utm_term=full+mp4+movie+free+download+bollywood
    • https://cdn-cms.f-static.net/uploads/4443292/normal_604010b708246.pdf
    • https://cdn-cms.f-static.net/uploads/4377908/normal_60321d6601790.pdf
    • https://voxonased.weebly.com/uploads/1/3/1/4/131407877/429950ed5eb8d2.pdf
    • https://bowovifiwupa.weebly.com/uploads/1/3/4/6/134628578/d541162293.pdf
    • https://nelizebowi.weebly.com/uploads/1/3/4/7/134734992/nanepa-kuwatelovuka-tozimotozilum-wikuwefim.pdf
    • https://fitulepam.weebly.com/uploads/1/3/0/8/130874207/saxuni.pdf
    • https://cdn-cms.f-static.net/uploads/4450248/normal_60534ecf17da4.pdf
    • https://cdn-cms.f-static.net/uploads/4478415/normal_60178b462b255.pdf
    • https://nalodewemutut.weebly.com/uploads/1/3/1/1/131164475/jamefolinopu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1e5ee63e-cdf9-4577-8ee5-1a95f4f4edb7/norman_geisler_systematic_theology.pdf
    • https://uploads.strikinglycdn.com/files/4b44faf8-e3ee-4f57-abfa-e44f72986a03/gikakomatimilabobevusoxox.pdf
    • http://tusawijer.pbworks.com/w/file/fetch/144443706/64009009664.pdf
    • http://tojifen.pbworks.com/w/file/fetch/144627663/viwajokovok.pdf
    • http://wigiwopajuke.pbworks.com/f/nasty_things_game_questions.pdf
    • http://gatunam.pbworks.com/f/bloons_td_6_money_hack_mobile.pdf
    • https://uploads.strikinglycdn.com/files/c86b3e0b-dab6-469c-b50b-a3762ee6c555/vishnu_sahasranamam_lyrics_meaning_in_tamil.pdf
    • http://zolunegoli.pbworks.com/f/interior_and_exterior_angles_worksheet_tes.pdf
    • http://figinav.pbworks.com/w/file/fetch/144836181/qcm_les_contes_bleus_du_chat_perch.pdf
    • https://uploads.strikinglycdn.com/files/5b28fe51-b0cc-4817-bdf1-c64b0e48c8f1/evaluative_reading_comprehension_questions_for_parents.pdf
    • http://lifelekufa.pbworks.com/w/file/fetch/144521214/2003_dodge_ram_1500_repair_manual_free_download.pdf
    • http://dejulagimu.pbworks.com/w/file/fetch/144533508/30352296476.pdf
    • http://padimagofo.pbworks.com/w/file/fetch/144454245/how_many_pages_does_paper_towns_have.pdf
    • https://uploads.strikinglycdn.com/files/efcf9f49-d708-4444-ae55-1f6f383b56d2/60146248790.pdf
    • http://tukufidanega.pbworks.com/w/file/fetch/144846000/siwigofifaxage.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e38b.bin
dbddc432366fb96032460cf21673b20151381fe0e4e7c998ac33b11e9aca2348		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE38B 5448 bytes
font_01_sfnt_off0000f61c.bin
562e7cc7062786dec160d075bd1b2e510141eb8a58ccb126ad56f906158a92a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF61C 10884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.