PDF malware analysis — malicious · 9a3e9198c3182302

MALICIOUS

PDF

183.2 KB Created: 2021-04-01 10:11:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: c4c0959d1aeef99a34b7861d24ee608d SHA-1: d313ab2065954231ac2b585b4e6f9f40def76063 SHA-256: 9a3e9198c3182302dc70fdd5c21358ec1db5b97aca348232ceb95020c03457cb

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document flagged by multiple heuristics as malicious, including a ML classifier and ClamAV. The 'SE_ADVANCE_FEE_SCAM_LURE' heuristic strongly indicates the document's content is designed to defraud the user. The presence of external URLs, such as 'https://nipisod.ru/wix?keyword=unloaded+tv+apk', suggests a redirection to a malicious site or a phishing page. While no scripts were explicitly extracted, the PDF format can embed JavaScript, which is often used in such lures to initiate further malicious actions.

Machine Learning

Nyx PDF Classifier malicious score 0.9170

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE

Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
QR-code redirect lure medium SE_QR_LURE

Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://nipisod.ru/wix?keyword=unloaded+tv+apk
- https://cdn.sqhk.co/nowonipewo/ZgeVVig/75081137655.pdf
- https://cdn.sqhk.co/nixafusoda/jggehgD/stachu_jones_kto_to.pdf
- https://cdn-cms.f-static.net/uploads/4481065/normal_602b25b1ad698.pdf
- http://tarekupi.scienceontheweb.net/bnf_74_free_download.pdf
- https://cdn-cms.f-static.net/uploads/4452152/normal_600c05392e264.pdf
- https://cdn-cms.f-static.net/uploads/4389570/normal_600b44d3506b2.pdf
- https://cdn.sqhk.co/xugavizira/jienx9f/xakumin.pdf
- http://vutisonoj.sportsontheweb.net/evolutionary_psychology_apa_definition.pdf
- http://juwaniwabi.medianewsonline.com/luiz_carlos_bresser_pereira.pdf
- https://cdn-cms.f-static.net/uploads/4388819/normal_602b464317e17.pdf
- https://cdn-cms.f-static.net/uploads/4454562/normal_600c70ba41a89.pdf
- http://jiwabozaxexe.mypressonline.com/wodebugajabatafilarerapem.pdf
- https://cdn.sqhk.co/junizafuzep/R3QeRO0/best_photo_video_maker_free_app.pdf
- https://cdn.sqhk.co/tisufupujeli/5Ozhcib/riptide_gp2_redeem_code.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.opentle.org
- https://627f215e-41ba-4aa4-9906-5f9f9d117739.filesusr.com/ugd/8ab72e_d0a7d659d3d2468c8508ca79d0d3a6a9.pdf?index=true
- https://b56e00ce-d729-42e9-814b-b9a4b194f5ba.filesusr.com/ugd/f6f93f_1bfd6a8d57f54758be7fd6ad6d20fd99.pdf?index=true
- https://0503187d-52cd-4237-9521-a3cb9bf551ae.filesusr.com/ugd/5bb01c_f0a55a06554b4eff859c08d86f7371cd.pdf?index=true
- https://9dc8676a-0e58-44ee-a512-e339c7094702.filesusr.com/ugd/7c0652_5257779fadfc44e5aa56fab0b1df8a63.pdf?index=true
- https://b6e49935-6d58-4bde-831f-6e0b746776d3.filesusr.com/ugd/7d321f_f9169f79d2c84526a283c85d56d9ad13.pdf?index=true
- https://39dd5e1d-a581-41ec-a80f-9e19245c660f.filesusr.com/ugd/c2656d_4139494ecbd34a19ad597cb536081ca5.pdf?index=true
- http://kesupipipiret.onlinewebshop.net/principios_de_administracion_financiera_gitman_libro.pdf
- http://zejibanunepi.myartsonline.com/gekepa.pdf
- http://bujekotu.atwebpages.com/25236432925.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
- http://scripts.sil.org/OFL
- http://www.gnu.org/licenses/gpl.html

Extracted artifacts 6

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_009_off0002a344.bin` `06c7d998ab103e2a738d5abe4a53343d256a2c5ef713a9e34d612bdb611c1829`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2A344	23760 bytes
`font_00_sfnt_off0001d0d6.bin` `0be08ac0abfa15c35c06f707ef15ce530d7e3fd2b0c9d2f9e37de9d8064d8b42`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1D0D6	37752 bytes
`font_01_sfnt_off00023803.bin` `f490e019fd996053c06b1ea9f7e8b0fa640d28b9c4793fe3f9081108e87d6645`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x23803	4796 bytes
`font_02_sfnt_off00024870.bin` `fbc35ba324248e066c2b52aa0084c747bce8022bc0e83d17e4321eb4b6e4f173`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x24870	4284 bytes
`font_03_sfnt_off000253ec.bin` `f4f4130cbeb742889b797ffa436e8015703478eea74b17c2f108a89a0e494034`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x253EC	9220 bytes
`font_04_sfnt_off00026da1.bin` `b97aecf9728a7aeea9fc77dceaf7d17b8376a1b5ee33710746610ce7bbd59104`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x26DA1	17844 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.