Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b3b032eed73dbb1…

MALICIOUS

PDF

83.0 KB Created: 2021-03-14 19:52:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dc7801beffdeaae4fb9e1b6faee09b9d SHA-1: d5aeda1c082257005f2dd3ee8fb60ad5ec1e01b1 SHA-256: 6b3b032eed73dbb1ac728374eadeb74eaf04b3abc534c4144114e6fe8fd4461c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'nipisod.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, suggests a lure related to educational content ('worksheet'). No scripts were extracted, but the presence of external URIs and the overall malicious verdict strongly suggest an attempt to redirect the user to a malicious resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=absolute+value+in+open+sentences+worksheet
    • http://marafonsport.site/darigurimanikuger1z8g.pdf
    • http://detonic-italia.website/lake_beulah_ms_fishing_report1gwod.pdf
    • http://jabilevij.mypressonline.com/82440801998.pdf
    • http://blockingscenery.com/fejujototisisozon0ddfa.pdf
    • http://raxejudesezix.scienceontheweb.net/burger_king_menu_specials_2021_south_africa.pdf
    • http://unlockdeals.shop/378806800534t0p3.pdf
    • http://itdiscounts.pro/553311486405qz7g.pdf
    • http://prechambre.xyz/fekar80sdh.pdf
    • http://fontawesome.iohttp://fontawesome.io/license/
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/rizijubovapuk/zurejemazi.pdf
    • https://8eccd3b7-fb20-4588-a5b5-4d8c58591879.filesusr.com/ugd/0e6328_3c2bb88bebce456199d0de3cfa548125.pdf?index=true
    • http://katilujovuge.rf.gd/mitel_5312_ip_phone_turn_off_voicemail.pdf
    • https://46c19374-600d-43be-a5f2-d8bf07c6fddf.filesusr.com/ugd/cc94a4_a3996a7ada0748f0b9ffea16c73e6cad.pdf?index=true
    • http://gedijusopekud.epizy.com/4liker_1._0_android_apk.pdf
    • https://f8206d31-21c4-4aef-9da9-e4259ded718a.filesusr.com/ugd/c2bdac_a3e7cb6e396c46e9bdb0754571ceaabf.pdf?index=true
    • https://s3.amazonaws.com/mubemutolewe/seporimefovutar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3a3.bin
338e030491a169884aefd2a0cf6bae0daef19f52583554c841dda619f337c201		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE3A3 4640 bytes
font_01_sfnt_off0000f386.bin
45ac07094e79e90016611dcbb34c0ddcc3b336df3222d42e9dcb79b88dda9bdc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF386 5248 bytes
font_02_sfnt_off0001055c.bin
105fc7ec721fb27b5062704611ef0edc9a764744871db438b2293efefa0edaa6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1055C 11948 bytes
font_03_sfnt_off00012e02.bin
cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12E02 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.