Malicious PDF — malware analysis report

Static analysis result for SHA-256 74f712972394c00a…

MALICIOUS

PDF

79.0 KB Created: 2021-03-21 22:34:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 7f511319f206e06d6faf48da6ff3a633 SHA-1: c9caf7bb5b9dc7ec829ddd71be69810cfb45788b SHA-256: 74f712972394c00a913ec51cb33db8b1b6e238fb2a46280ee1dd9a27f596846b
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains embedded URLs, including one pointing to 'nipisod.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to interview tips, indicating a social engineering tactic to encourage users to interact with the malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/aws?utm_term=interview+tips+questions+and+answers+pdf PDF link annotation
    • https://cdn.sqhk.co/podoxato/X5nidT3/detailed_mandala_coloring_pages_for_adults.pdfIn PDF document text
    • https://cdn.sqhk.co/likafupat/idighaJ/9273365902.pdfIn PDF document text
    • https://cdn.sqhk.co/pulununese/eUjgx6d/slice_of_life.pdfIn PDF document text
    • https://cdn.sqhk.co/retobumoki/hjkXCjh/pixel_gun_3d_battle_pass_hack_2020.pdfIn PDF document text
    • https://cdn.sqhk.co/lirebirab/eQhbqty/move_to_sd_card_samsung_tablet.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/vuliwisuwig/itunes_store_app_won_t.pdfIn PDF document text
    • https://s3.amazonaws.com/zopenave/wonder_bethel_chords.pdfIn PDF document text
    • http://gevegure.rf.gd/45788934614.pdfIn PDF document text
    • https://s3.amazonaws.com/lomogas/dress_code_formal_dinner_cambridge.pdfIn PDF document text
    • https://s3.amazonaws.com/dufekifaral/commando_2013_full_movie_for_mobile.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7afb7d60-baea-441f-b3f6-5bcff66fba59/iomega_storcenter_ix2_software_download.pdfIn PDF document text
    • http://kenomubuwisi.epizy.com/67959385239.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7aa5c53f-86a7-4deb-8afd-f2626a3132a7/patton_heater_model_puh680_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/ruzaganog/robolasorovapam.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bfd7ad7b-686c-4685-948c-b42d4b73978d/muzagumopupijojisux.pdfIn PDF document text
    • https://s3.amazonaws.com/zesixefe/atoms_isotopes_and_ions_worksheet_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/wamatasamegu/63914725283.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f64892cd-bcd2-4131-8d3c-e026ce327082/what_is_culture_in_art_history.pdfIn PDF document text
    • https://s3.amazonaws.com/kokesatodixon/idea_central_del_cuento_gallina_degollada.pdfIn PDF document text
    • http://rusireges.epizy.com/sojelosuwedova.pdfIn PDF document text
    • https://s3.amazonaws.com/pisedij/xolazage.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF9C1 5216 bytes
SHA-256: 5172adfb9f4d3e01b92f939a2c7db92f5789adaa6d1fcb0e772a4267b57b0856
font_01_sfnt_off00010ba2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10BA2 10544 bytes
SHA-256: 260a4997aab771747ce979271bc670c2b8597b05d262d4598691e99984917f3f

Open this report in the interactive analyzer, or submit your own file for analysis.