Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cc94aad55d56243…

MALICIOUS

PDF

88.0 KB Created: 2021-05-11 23:42:43 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: db73841fcc7ff0aaa144030f8be2c3d5 SHA-1: 4764299f96b9bd25131bf7e42452ff479f7f574d SHA-256: 8cc94aad55d5624301901a2c05f1ddbc59f43c3373b87c464da9c67c5f0ab7cc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, with a high risk score. It contains an embedded URL pointing to 'nipisod.ru', which is likely part of a phishing campaign. The document body, though heavily obfuscated, suggests a lure related to a 'Cissp all in one exam guide pdf'. No scripts were extracted, but the presence of external URIs and the overall detection suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=cissp+all+in+one+exam+guide+pdf
    • http://keepxufi.space/borokuselofuduratog0wnv.pdf
    • http://naxajogilelog.medianewsonline.com/zasawax.pdf
    • http://bopolubolef.mywebcommunity.org/28360813184.pdf
    • http://zabolojisag.getenjoyment.net/how_to_get_back_to_2d_view_in_autocad.pdf
    • http://zevibeponakat.getenjoyment.net/tetipifuxopotesanuj.pdf
    • http://idealslimitaly-ufficiale.site/sixinezizanoneletafagowaf8key7.pdf
    • http://carinsusa.info/what_are_the_five_process_groups_of_project_managementq5h1p.pdf
    • http://kersita.space/xesuvudibugisibutajonak6rg1.pdf
    • http://clientbluebadge.com/dopevodiruxapuu856.pdf
    • http://lozipazom.sportsontheweb.net/lg_ce0168_model_name.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1ebce30e-ecef-4b12-86b4-f5c8a05d6d2a/36536524202.pdf
    • http://furipurisebete.onlinewebshop.net/71967159911.pdf
    • https://s3.amazonaws.com/gurowozenupifi/afrobeat_riddim_instrumental_free.pdf
    • https://uploads.strikinglycdn.com/files/67d86f63-0074-4396-ab31-65ccb8b30c78/nedekovigidekafapel.pdf
    • http://bitines.myartsonline.com/how_do_you_turn_a_ratio_to_a_fraction.pdf
    • https://uploads.strikinglycdn.com/files/7b0bd448-5591-4b91-a65f-d9de9bad0121/78014543100.pdf
    • http://xowuzaxu.onlinewebshop.net/a_practical_english_grammar_exercises_1_third_edition.pdf
    • https://s3.amazonaws.com/gonima/ejemplo_de_texto_argumentativo_con_su_estructura_interna.pdf
    • https://s3.amazonaws.com/donarepemi/lg_dryer_repair_san_diego.pdf
    • http://gumusimigogasuz.onlinewebshop.net/ejercicios_composicion_centesimal_3_eso.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f78d.bin
221ab8c3a30a330293ac532b970f99a8d39e94eb9698b5513e906c7191802b2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF78D 3200 bytes
font_01_sfnt_off0001030a.bin
771f5d1cc2def7f3a266d33d0a57126a7d3a3e9364d431fee1f0ba6be5cd1a76		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1030A 5240 bytes
font_02_sfnt_off000114d5.bin
18cc49cb8250baca49a2a9a66d4039228d3b60f72773a8aa3fecbdddd0826366		 pdf-font-stream PDF embedded font (sfnt) at offset 0x114D5 11404 bytes
font_03_sfnt_off00013b7b.bin
10870da844573615f323bfd7084e94cc064fb5b63d2b27e01fb189e311c4e78e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13B7B 16460 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.