Malicious PDF — malware analysis report

Static analysis result for SHA-256 9bb1cf1d50ab793d…

MALICIOUS

PDF

81.2 KB Created: 2021-04-07 06:50:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f447de521bf2587ea260f11909f776eb SHA-1: 27993d9c70a279aa41c0aa4d0d4f2905cdcbb7f8 SHA-256: 9bb1cf1d50ab793dc089590838b5da0d230e1d9ded60d165c844c9c463f68193
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing or trojan. The document body, though heavily obfuscated, contains keywords related to 'Eddie Bauer return policy time limit', suggesting a lure. An embedded URI points to 'https://nipisod.ru/wix?keyword=eddie+bauer+return+policy+time+limit', which is likely the malicious payload delivery URL. The presence of embedded URLs and the phishing lure heuristic indicate a likely spearphishing attachment attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=eddie+bauer+return+policy+time+limit
    • http://wordsideget.top/administracion_financiera_ochoa13oee.pdf
    • https://cdn.sqhk.co/xozifejor/aiUqhfA/world_at_arms_hack_tool_for_pc.pdf
    • https://cdn.sqhk.co/bizujutenifo/a6ijeta/74812327067.pdf
    • http://reznitskygallery.com/81522872118nvt6s.pdf
    • http://instup.xyz/jonedofodebtvxh.pdf
    • http://allerop.xyz/73069786518ljosi.pdf
    • https://cdn.sqhk.co/baruduwege/mMG7jy0/45910587955.pdf
    • http://dombitarf.ru/losalexiwefugokodefanurilfhl5.pdf
    • https://cdn.sqhk.co/wuvevalor/hehjihu/geselazobikividosekuwiwuz.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/murudute/multiplication_using_associative_property_worksheets.pdf
    • https://s3.amazonaws.com/kofabube/lame_deer_seeker_of_visions.pdf
    • https://c6f55193-7475-4343-97dd-33cb3b141b6a.filesusr.com/ugd/808d8c_c77fa87724a0475680ef757a91b19714.pdf?index=true
    • https://746420f6-3007-491b-ba72-fd43be5094e5.filesusr.com/ugd/277b62_fe17154ed7ce4721b17b4dcfcac08c7a.pdf?index=true
    • https://uploads.strikinglycdn.com/files/a908f5c5-c304-47c4-ab85-a57cafeec09d/george_washington_gomez_audiobook.pdf
    • https://uploads.strikinglycdn.com/files/5792c1c5-6bba-4e82-a6af-9b797aaf981f/maschine_mikro_mk2_studio_one.pdf
    • https://f37c3615-20b0-4e70-b1e7-2acf34113780.filesusr.com/ugd/1e533a_a5cb013a7af54f49b5a096f565dc81be.pdf?index=true
    • https://uploads.strikinglycdn.com/files/745fcfad-621a-4d37-9fcb-c6deb7adb663/pugeb.pdf
    • https://s3.amazonaws.com/nisiwanolom/how_to_simplify_exponents_with_fractions_and_variables.pdf
    • https://0f7a2101-273c-4f7f-b1fd-079d1ad923c1.filesusr.com/ugd/a7ea6f_8fe08a833581425c8039f75003ffa57c.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2c4fb450-73af-44f2-8a42-49afef9dd87b/91147562694.pdf
    • https://s3.amazonaws.com/duzexefemosaxe/vufabujixulijezexi.pdf
    • https://858e1da1-ad31-4e5b-aec0-89c59c6c71f6.filesusr.com/ugd/6240f8_9fda6af042a14b5895fecdb9409f6982.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ec644040-e31c-4494-8098-c25bb0c1e141/the_history_of_sexuality_vol_1_summary.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef83.bin
c6e9de14f8c33162d9f11172f2297391959357e057ed0d5cd535ed6ffaa4cddd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEF83 5124 bytes
font_01_sfnt_off000100d2.bin
7499b1d7c0f0d245a8f598b7e52748bbc66ccd982efd1ffc9ecd75b7b98bdfc3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100D2 11376 bytes
font_02_sfnt_off00012774.bin
9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12774 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.