Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ef067eed60fa2b0…

MALICIOUS

PDF

82.9 KB Created: 2021-03-14 23:02:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 297dcc4104fad2ad575337efaaf26f04 SHA-1: 5c32fc473bbd6afde44b23649b03980781b6199d SHA-256: 9ef067eed60fa2b0d0880998454a655739d5f012cae6d0835a2e3723a0d57c4e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'https://lozipotod.ru/wix?keyword=toshiba+regza+42x3030d+tv+manual', suggesting a phishing or malware distribution attempt disguised as a document. Although no scripts were explicitly extracted, the PDF structure and embedded URLs indicate a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=toshiba+regza+42x3030d+tv+manual
    • http://mobile-media.moscow/construction_project_scope_statement_examplexhzno.pdf
    • http://gravkamen.ru/wivawawidibuketavuzuvomwckp.pdf
    • https://gadabuji.weebly.com/uploads/1/3/4/7/134715747/lijebaxipozal-zujejaso.pdf
    • https://lalupapetawosi.weebly.com/uploads/1/3/2/8/132816164/22f7d84ea.pdf
    • https://cdn.sqhk.co/kososojog/daTjegi/crossfire_trail_dvd.pdf
    • https://cdn.sqhk.co/rurizibaxami/ibiivaV/car_part_finder_reg_number.pdf
    • https://degegoza.weebly.com/uploads/1/3/0/8/130873855/wafuxibudod.pdf
    • https://cdn.sqhk.co/jejekije/jjgjTw9/is_the_mn_vikings_game_on_tv_tonight.pdf
    • https://cdn.sqhk.co/mofekuma/jhgdhij/new_bollywood_remix_song_2020_mp3_download.pdf
    • https://cdn.sqhk.co/dejijadu/TMKjcj9/switch_pro_controller_black_friday.pdf
    • http://krepezh.guru/383022537694ivml.pdf
    • http://my-favshoph.online/bates_history_and_physicalkifg7.pdf
    • http://mastericy-chistoty.ru/rolirewefi63k68.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8c0090e2-7b8a-4349-b68d-18bfb798878d/61918402421.pdf
    • https://33b7cf8b-1cb2-46d9-9063-17e97cba5e80.filesusr.com/ugd/9edd50_a4ac70f452034f9fbe34ad8a5ce6ee58.pdf?index=true
    • http://dubuxizomigowab.rf.gd/epson_workforce_wf-3640_wireless_color_all-in-one_inkjet_printer_with_scanner_and_copier.pdf
    • https://1e16f6d7-285b-4488-bf07-d3e24ac90e20.filesusr.com/ugd/417718_cb0a13698b9e44678abfa931840aeb84.pdf?index=true
    • https://eb40363d-1d1f-4170-a897-f23f0f433116.filesusr.com/ugd/2a1429_7afa4c4139514b58a1a2ac8e8c4137cc.pdf?index=true
    • http://wedepije.epizy.com/can_you_use_a_dremel_to_cut_stone.pdf
    • http://samupuvigerolo.rf.gd/chlorosulfonic_acid_safety_data_sheet.pdf
    • https://uploads.strikinglycdn.com/files/dce6fee9-3668-4c12-a9f9-77f60c6a3aa7/pabamodo.pdf
    • https://uploads.strikinglycdn.com/files/9c21ea1a-6e5b-4409-ba36-0eca815f07f8/wubejukulala.pdf
    • https://uploads.strikinglycdn.com/files/5435e03f-79de-4a68-9581-a73df8676e8a/vapijikepipikidusugogun.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010361.bin
c3be38cc43588211b5ccc991868e38236b0da651debed93f5e80ce16e1e68442		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10361 6032 bytes
font_01_sfnt_off000117d3.bin
d8fc65b3eb08eb66d72272e3f2583ce627bfb6a075bb306b8d0e0bf2d5a52722		 pdf-font-stream PDF embedded font (sfnt) at offset 0x117D3 11260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.