Malicious PDF — malware analysis report

Static analysis result for SHA-256 a86ec1ae5d263c84…

MALICIOUS

PDF

88.3 KB Created: 2021-03-18 18:12:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e5fa7a52dca509991b33c2db5d9ca6b5 SHA-1: c8f40d096d784c1485ed93ea9556264479452bf7 SHA-256: a86ec1ae5d263c84c56b43206aba1a1343ea81d1fe968ad31395c735ce4d6055
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing trojan. The embedded URL 'https://nipisod.ru/award?keyword=catan+rules+pdf' suggests a phishing lure, likely attempting to trick the user into downloading further malware or providing sensitive information. No scripts were extracted, but the PDF structure and embedded URI indicate a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=catan+rules+pdf
    • https://cdn.sqhk.co/matajikiwov/vhcfUha/medical_certificate_format_for_school_admission.pdf
    • https://cdn.sqhk.co/modonasuje/bha0M3O/stickers_de_naruto_para_telegram.pdf
    • https://static.s123-cdn-static.com/uploads/4366385/normal_600816a92a244.pdf
    • https://puzomukasudugun.weebly.com/uploads/1/3/4/8/134865935/gunuxe.pdf
    • https://cdn.sqhk.co/xataruzepape/jhsjahi/learn_english_vocabulary_words_offline_free.pdf
    • https://cdn.sqhk.co/gunonutib/jeKijHx/how_to_start_a_letter_requesting_information.pdf
    • https://cdn.sqhk.co/letonolomo/aEWigIX/nissan_idle_air_control_valve_cost.pdf
    • https://gidutuzewefira.weebly.com/uploads/1/3/1/3/131380066/1694899.pdf
    • https://cdn-cms.f-static.net/uploads/4467318/normal_60373c1977ed9.pdf
    • http://purumobakeleju.22web.org/marathi_sad_whatsapp_status_video_free.pdf
    • https://buranujepexu.weebly.com/uploads/1/3/4/3/134339299/vobekawigelowuf_gopata_bapijozavelivet_gunotutevu.pdf
    • https://basavorulifa.weebly.com/uploads/1/3/4/8/134899730/3053992.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e7c38eef-7892-469f-b547-22e3bbe9a8ae/the_most_human_human_summary.pdf
    • https://uploads.strikinglycdn.com/files/171584b4-3d5f-4652-aea7-966b175b9fbc/sesidus.pdf
    • https://badbb018-ab4e-499b-b788-960949b82e3d.filesusr.com/ugd/4f4c56_15ed67dd496b47c18c43cea3664b736a.pdf?index=true
    • http://kamegowemegoguw.rf.gd/christmas_carol_lyrics_book.pdf
    • https://9db8f275-5044-409a-aa1b-3306d9dda9bd.filesusr.com/ugd/361f4b_7079d988ecc24fb985ee82e5f5c891e2.pdf?index=true
    • https://7980b0ff-2efe-48f4-a442-6c87bca80713.filesusr.com/ugd/9bd8c3_923fc66130934e0ebbd91f5f63505098.pdf?index=true
    • http://xusonusoxe.epizy.com/73725646076.pdf
    • https://uploads.strikinglycdn.com/files/dfcd9bc4-f5b0-4d44-a0b0-256690642676/words_their_way_spelling_inventory_worksheet.pdf
    • https://ad323f3e-245e-4e3c-8b16-de91fefec063.filesusr.com/ugd/5ea691_bc41cd67a9684dfca57f6ac7b4eba06f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/51bd6610-d89f-4552-9979-49536e375266/37871310686.pdf
    • http://rizibapuzaduxe.epizy.com/34130964327.pdf
    • https://uploads.strikinglycdn.com/files/be3e76d9-80b6-4771-a6e7-ef055b1fe3be/nilosajuradididosuwak.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fd37.bin
f390bef0ad8e41d45188a0c3187732491b7d92bebb0fac1dd7d5ea9915f39569		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD37 4940 bytes
font_01_sfnt_off00010e05.bin
b8e04332c9677abac35b615770ed5c5ce59a56c693dbafcf418b3602212d3833		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E05 2344 bytes
font_02_sfnt_off0001184b.bin
705fd1f581dc2caef405728cc3784642d682a21c7ff81eb10dbfaac52e53909a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1184B 11032 bytes
font_03_sfnt_off00013e35.bin
e15a1281d5822949f1e77669e824eae5514ae62c72e5676204b82dc78d7785f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13E35 16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.