Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f0dda57c52dea3d…

MALICIOUS

PDF

153.2 KB Created: 2021-04-08 10:53:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 7cea08b97fd0e698f5cd4ba1a197bf12 SHA-1: 66215f2c4e44e4ebda6e908151232d775eb1f1dd SHA-256: 7f0dda57c52dea3d95eb075318764ae8cc80061a0fb2705b713aa5e910a3427f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'https://nipisod.ru/strik?utm_term=death+note+manga+anime', which is a strong indicator of a phishing or malware distribution attempt. The document body, though heavily obfuscated, suggests a lure related to 'Death Note manga anime'. No scripts were extracted, but the presence of embedded URLs and the high risk score strongly suggest a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=death+note+manga+anime
    • https://static.s123-cdn-static.com/uploads/4466408/normal_5fc9ce4b62a23.pdf
    • http://complect-tech.ru/parugepesaglxam.pdf
    • http://dofujifeluradep.medianewsonline.com/how_to_reset_my_mitsubishi_air_conditioner.pdf
    • https://gomimujexewawid.weebly.com/uploads/1/3/1/0/131070583/1157c6458cc04.pdf
    • https://cdn-cms.f-static.net/uploads/4485001/normal_603ab1d775e5f.pdf
    • https://vamibigomez.weebly.com/uploads/1/3/4/4/134438308/059c506fcf1cbf3.pdf
    • http://mmuuue.space/pioneer_deh_80prs_network_modemdxd2.pdf
    • https://womegirig.weebly.com/uploads/1/3/4/5/134506381/7345435.pdf
    • http://grinallex.shop/tomb_raider_film_streaming_italianoat0be.pdf
    • https://cdn-cms.f-static.net/uploads/4498645/normal_6041d5894cf87.pdf
    • http://napowojeba.medianewsonline.com/sotodekutijiforokilana.pdf
    • http://seomagnat1.online/averil_coxhead_academic_word_listl1u9o.pdf
    • https://xadifera.weebly.com/uploads/1/3/1/4/131438156/xinuwi.pdf
    • https://cdn-cms.f-static.net/uploads/4500678/normal_602197fa2229a.pdf
    • http://murimubijejaba.mygamesonline.org/jexikofafibixixaku.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/5e4f1489-26b4-4f84-b0c2-e93e07a0bff3/the_secret_garden_summary_chapter_2.pdf
    • https://uploads.strikinglycdn.com/files/23d045b2-cfe6-414d-945f-d6c0ea122a07/sylvia_plath_poem_love_letter.pdf
    • https://uploads.strikinglycdn.com/files/a19d054f-a92f-4592-b353-621b55884fdf/bewajuxurusowovajogu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001af5b.bin
125a5f7f6ac1dc884d95e6a8dc890a8089da10ea04bb68059056732252756433		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1AF5B 33324 bytes
font_01_sfnt_off00021730.bin
5d8279ffcdacf9809c30ec352f7ceb061fb8c81ac5e3ad441b264e79880bfe7a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21730 4792 bytes
font_02_sfnt_off00022762.bin
74ffb8363cc6f5acbc73f9d0bf17aa4dcc66f3a8fb92f35f8cc09cf2cd21f6fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x22762 15556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.