Malicious PDF — malware analysis report

Static analysis result for SHA-256 a165560635b71937…

MALICIOUS

PDF

78.6 KB Created: 2021-03-11 21:51:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 59dd4e6cd1de79f43316839d6bdda4cb SHA-1: 212aa0a109caf2fbad553beef2568293f7f482f7 SHA-256: a165560635b719375a443281e46742e9bdaf9057b214dd0bdf90d439b3de578f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'lozipotod.ru', which is likely used to host a malicious payload or phishing page. The document body, though partially corrupted, suggests a lure related to 'frequency table examples'. No scripts were extracted, but the presence of external URIs and the overall detection profile strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=tabla+de+frecuencia+ejemplos PDF link annotation
    • http://frukt.fun/kitexaxifonagenebixonujtwizj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379032/normal_601eee14ddae4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4420599/normal_6023670256769.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384460/normal_5fdb5fe43e011.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384655/normal_601cb40526e3c.pdfIn PDF document text
    • http://goldstein.capital/madokugegukuzdo.pdfIn PDF document text
    • http://limuzinof.ru/18676515816pdjfg.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/pevarijidasalop/67056206181.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e377d20-5dfa-4b0c-a4e0-c27e20c095a1/how_much_is_a_nintendo_ds_lite_games_worth.pdfIn PDF document text
    • https://s3.amazonaws.com/wefemabeni/collapsing_toolbar_layout_android_tutorial.pdfIn PDF document text
    • https://s3.amazonaws.com/zopenave/bogupalajej.pdfIn PDF document text
    • https://s3.amazonaws.com/gumegulaxi/roxofabomariwakagajutas.pdfIn PDF document text
    • https://s3.amazonaws.com/xoferuzu/zisaxemivokejowibabira.pdfIn PDF document text
    • https://s3.amazonaws.com/zodawanuror/games_for_windows_10.pdfIn PDF document text
    • https://s3.amazonaws.com/wozowuledij/banshee_full_movie.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c1a41020-4146-46cc-8d49-0e030166e73e/my_printer_turns_on_by_itself.pdfIn PDF document text
    • https://s3.amazonaws.com/sumesawoxajew/academic_library_interview_questions_and_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/kavalukato/76268110109.pdfIn PDF document text
    • https://s3.amazonaws.com/nagudo/active_learning_method.pdfIn PDF document text
    • https://s3.amazonaws.com/zifozujiwi/what_is_the_relationship_between_the_location_of_earthquakes_and_plate_boundaries.pdfIn PDF document text
    • https://s3.amazonaws.com/tobobowu/ich_guidelines_for_stability_studies_of_tablets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a61b8c65-99a9-4907-9217-b06a87f1daa7/pobevigubozivivaf.pdfIn PDF document text
    • https://s3.amazonaws.com/divexikav/online_calendar_template_may_2018.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e723.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE723 5268 bytes
SHA-256: ed702119d58ae0ae317c45b1f7e2c59d212d264d6e70f4e37ff8578e4f5709c6
font_01_sfnt_off0000f8e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8E0 11416 bytes
SHA-256: 6630e2bcddbb2a410ad0ed1c8e9a7677bab3c3f4879992301509b2acd03a75e1
font_02_sfnt_off00011d5e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D5E 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.