Malicious PDF — malware analysis report

Static analysis result for SHA-256 72c3d5b5a8c2a059…

MALICIOUS

PDF

74.6 KB Created: 2021-03-27 20:38:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b90d89b345ab722c937622889a11cffd SHA-1: 968a4dc13a0544547d696c378bcf3d9ba932cca9 SHA-256: 72c3d5b5a8c2a059e3acbfb39eac6293b07fba9526eef8bc895392eabfab081a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The embedded URL, https://lozipotod.ru/wix?keyword=lesson+12+homework+5.5+answer+key, is presented as a homework answer key, serving as a lure. While no scripts were explicitly extracted, the PDF structure and the presence of external URIs suggest it's designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=lesson+12+homework+5.5+answer+key
    • https://cdn.sqhk.co/moleselofa/c6LlecF/movietickets._com_gift_card_discount.pdf
    • https://cdn-cms.f-static.net/uploads/4419218/normal_5fd8c2aeec16e.pdf
    • https://static.s123-cdn-static.com/uploads/4485318/normal_60058e1c5c6c1.pdf
    • https://static.s123-cdn-static.com/uploads/4465545/normal_6009a509dddd4.pdf
    • https://cdn.sqhk.co/nafusomo/jhihgez/6311068614.pdf
    • https://cdn.sqhk.co/jememobak/igjggfX/47251123506.pdf
    • https://cdn.sqhk.co/wogokodu/dKgfwid/mixanoz.pdf
    • http://sadeseta.iblogger.org/aquaculture_project_proposal.pdf
    • https://cdn-cms.f-static.net/uploads/4404983/normal_6035c3691baaa.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/16937831-a2f1-40e9-9e30-ee0de74ff4a9/63103803255.pdf
    • https://uploads.strikinglycdn.com/files/3c5b7621-0317-4e3c-ab2a-d100d50b144a/nextbike_berlin_map.pdf
    • http://fozovevozasox.epizy.com/google_excel_sheet_shortcuts.pdf
    • https://s3.amazonaws.com/suxuzubojut/what_is_chi_gong_breathing.pdf
    • https://s3.amazonaws.com/labitajaxatufib/beethoven_pathetique_sonata_2nd_movement_sheet_music.pdf
    • https://uploads.strikinglycdn.com/files/0a431e96-2e82-45f9-a640-1d2d61225b6d/1996_jeep_cherokee_for_sale_washington_state.pdf
    • https://s3.amazonaws.com/libowebujakux/java_video_lessons_free.pdf
    • https://uploads.strikinglycdn.com/files/76e51000-8c29-47c9-b16a-24fe15213e6b/api_570_exam_dates_2019.pdf
    • https://s3.amazonaws.com/vitelitubovuluj/97765769754.pdf
    • https://dd3528e8-ded0-4753-843e-0d3cb9f542e7.filesusr.com/ugd/4d6844_5f75132701024d059f441b513d22f6b6.pdf?index=true
    • https://be9c8297-50e9-4ec8-be22-7cc4068ef96a.filesusr.com/ugd/fc3b0b_516364995158404c8555654a51e414d7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/12ce26d7-e7ff-4925-b496-6982d2d7cebb/88021671969.pdf
    • https://e4034479-4ead-418b-af8c-5be8dc72bdbe.filesusr.com/ugd/1e8759_7b117a1231ee4519924a88c8e5231048.pdf?index=true
    • https://s3.amazonaws.com/jalasilunaz/42663714515.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e20b.bin
bd3bcf9e7964ec81f83b9a695474948abb2ba5cb03d985628efc45279dff59fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE20B 5432 bytes
font_01_sfnt_off0000f484.bin
89d051c34a010727c4892dae81305aec8a4222ee7353050dc71e621f2a93654c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF484 11200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.