Malicious PDF — malware analysis report

Static analysis result for SHA-256 8332878c028d4c3e…

MALICIOUS

PDF

78.2 KB Created: 2021-03-22 07:40:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cf7b3bfae92c7531f24c2860ab1885ec SHA-1: 5cd0f6765308f1b160038a4563338482ccff50d8 SHA-256: 8332878c028d4c3ed29ddf06d62d15b9af7515cbfa5abf306a94374439d150c4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by a machine learning classifier and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to 'lozipotod.ru', which is likely part of a phishing campaign. The document body, though heavily obfuscated, suggests a lure related to a 'Panago pizza menu pdf'. No scripts were extracted, but the presence of external URLs and the phishing detection strongly indicate a malicious intent to deceive the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/award?keyword=panago+pizza+menu+pdf
    • https://sujujawajiz.weebly.com/uploads/1/3/5/9/135964945/gulezabi.pdf
    • https://xelipifexejup.weebly.com/uploads/1/3/4/8/134848770/0eb4dc45a2ae23.pdf
    • http://trysoda.pro/how_to_write_a_critically_appraised_topic7ijpi.pdf
    • https://static.s123-cdn-static.com/uploads/4407788/normal_5fccc93bb6111.pdf
    • http://br1.red/tajitamap7e1s7.pdf
    • https://static.s123-cdn-static.com/uploads/4467560/normal_5fe3f295b46a1.pdf
    • https://static.s123-cdn-static.com/uploads/4410714/normal_5ff0b05e0d5c3.pdf
    • https://cdn-cms.f-static.net/uploads/4392873/normal_6035d28564fb5.pdf
    • https://jimiwijir.weebly.com/uploads/1/3/4/5/134525211/5986151.pdf
    • https://cdn-cms.f-static.net/uploads/4366947/normal_6029989c5f3d8.pdf
    • https://cdn-cms.f-static.net/uploads/4457332/normal_6049946532c1a.pdf
    • https://cdn-cms.f-static.net/uploads/4387218/normal_5fe7ca0d18026.pdf
    • https://mewukonil.weebly.com/uploads/1/3/4/0/134096476/natowuvubaboma.pdf
    • http://mabay.fun/comma_exampleslbaka.pdf
    • http://parhelifrl.space/zepalalitpwjp.pdf
    • https://static.s123-cdn-static.com/uploads/4496826/normal_60086aafb5067.pdf
    • https://ropupapufodugut.weebly.com/uploads/1/3/4/6/134650221/jurus-gojego-kukojuvi-lifakumupegaz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/f8037a81-8420-43c1-b298-2cc298508a76/ridinupo.pdf
    • https://uploads.strikinglycdn.com/files/5d5510c8-b592-4636-a8aa-d8913c3cc62d/what_cards_are_in_a_traditional_tarot_deck.pdf
    • https://uploads.strikinglycdn.com/files/40bd65a2-fc68-4073-a9d0-2c759e9ca9ec/the_interlinear_niv_hebrew-english_old_testament.pdf
    • https://uploads.strikinglycdn.com/files/fab9aa84-8a71-4a9b-b8ef-46433fd01610/kunibixipileniputimut.pdf
    • https://uploads.strikinglycdn.com/files/0890f588-3b40-41a3-9742-c79aad915957/epson_wf_2540_cartridge.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f511.bin
df9bc9f27b9a4a398c9d2ea9e37c2fc95c0e1f7c423f964c75cb90613e8717c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF511 5104 bytes
font_01_sfnt_off00010671.bin
60b95cbaf45d91662a62514ccd1b877d8b881dec9cd2691a8beb556a90be7435		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10671 11368 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.