Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f0d116edbece2a0…

MALICIOUS

PDF

80.7 KB Created: 2021-03-06 05:21:17 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4a799a0c7bbbb4603e3cb818a45a4337 SHA-1: eab3eb4cc7afbd177b3abb9dd300a603f192bf11 SHA-256: 9f0d116edbece2a00008943d981b2f24dec2e9324e733803eef0de666a4d6b57
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'lozipotod.ru', which is likely used to deliver a malicious payload or redirect the user to a phishing site. The document body, though heavily obfuscated, contains text related to 'hyper havoc mountain bike assembly', suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=hyper+havoc+mountain+bike+assembly
    • http://kellys.space/gurps_4th_edition_books3sboc.pdf
    • http://bevaxifiro.22web.org/what_is_the_potter_house_in_the_bible.pdf
    • https://cdn.sqhk.co/gaxozamikoge/dqhcjen/64985282895.pdf
    • https://cdn.sqhk.co/guranotup/Rvighiw/86741766912.pdf
    • http://edayafar.xyz/is_a_recumbent_bike_good_for_weight_losshto5b.pdf
    • http://jaxebememapi.iblogger.org/audio_bible_online_free.pdf
    • http://vajununer.iblogger.org/xizoxoresilemobomu.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/fidefofudi/basic_paragraph_structure_worksheet_key_2.pdf
    • https://dca540c6-954d-4243-9f09-0921753db957.filesusr.com/ugd/974a4e_030d2c8d8f204820b23b9d843a1d42ca.pdf?index=true
    • https://s3.amazonaws.com/voxazedisula/9_animal_phyla.pdf
    • https://s3.amazonaws.com/bulozor/discussion_research_paper_example.pdf
    • https://013c3ecd-17dd-4738-ad87-554153c764a5.filesusr.com/ugd/36f25b_a61c0c7e38524d73af0bb9660929d76d.pdf?index=true
    • https://4e4301d6-cc9a-4939-960a-6b497c1efea6.filesusr.com/ugd/d78803_b08ca01b5eda44f09cf257f409a670b5.pdf?index=true
    • https://85377554-d84f-42a6-a955-c87f7d5d3d8c.filesusr.com/ugd/dd4472_195f46712284487493d96a19131d4d76.pdf?index=true
    • http://gajefeni.rf.gd/kipakakosuganopuvutojif.pdf
    • https://s3.amazonaws.com/lorugipopuxe/voluxedufakebaligonowe.pdf
    • https://a68e2ff5-bf17-48e3-82d4-ceb975b85758.filesusr.com/ugd/760101_4ec791f74e4349c181b493048773d4c7.pdf?index=true
    • https://101c3d73-5e22-4da1-a203-a3a2a794ce88.filesusr.com/ugd/69a512_b4bd020db7674f89944512d6e2f3d36e.pdf?index=true
    • http://kufuravolej.rf.gd/derived_class_template_constructor.pdf
    • https://e905e09d-7ddd-4aab-833c-73500e817873.filesusr.com/ugd/f4c08b_fc9d8ed070194487bfea13d85b45ce4b.pdf?index=true
    • https://3176e400-c268-4dc0-8d69-08eae86937f8.filesusr.com/ugd/ea2f88_90111c0f296f4035aaece0fb74a0bde3.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe50.bin
ebfb1c6c9ce21cc09ab7786b98bc4beb7989f53c2b2fb2b9a4e03f8b38b8ff9e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE50 5500 bytes
font_01_sfnt_off000110e0.bin
34f03a0918b4a2a0d9d6a179ee2b484b9a62342ff184d68cae437674120c10a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x110E0 10732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.