Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8a5ab044f783195…

MALICIOUS

PDF

317.9 KB Created: 2021-04-21 12:54:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 76fb86e4b38403e7899634eb9a8d9444 SHA-1: e6bec2f042b3e9ba34bc015fec683f228f385693 SHA-256: a8a5ab044f7831957688ae12b5c23a7d2d62a70bb6165a36f87badda009df049
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://nipisod.ru/strik?utm_term=historia+del+derecho+romano+kunkel+resumen', which is a strong indicator of a phishing or malware distribution attempt. The document body, though heavily obfuscated, suggests it is masquerading as a resource related to Roman law, likely to trick users into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9413

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=historia+del+derecho+romano+kunkel+resumen
    • https://cdn.sqhk.co/gisepavuv/fRwiehi/pencil_sketch_ideas_krishna.pdf
    • http://hookup754.fun/rimegerolurom188pr.pdf
    • https://cdn.sqhk.co/xifobariw/cieUcgc/pneumonia_23_vaccine_information_sheet.pdf
    • https://cdn.sqhk.co/vekunego/iIn3ifX/dupudugujuxuwev.pdf
    • http://mezogevap.mypressonline.com/vogugibawejumowafeme.pdf
    • https://cdn.sqhk.co/gosukutusu/fRhdxra/1299666271.pdf
    • https://fotiterik.weebly.com/uploads/1/3/5/3/135328456/pulakutexigubo-xowasugesez-kuxoxawakakol-xofamumigabuk.pdf
    • http://rkconstructionsucks.com/botejilibapawujozukasar1vdf2.pdf
    • http://sufofure.mywebcommunity.org/synonyms_worksheets_for_6th_grade.pdf
    • http://buylettersonline.com/woods_wion_50054_outdoor_wi-fi_smart_boxquks2.pdf
    • https://nagiliju.weebly.com/uploads/1/3/1/4/131412426/xagej.pdf
    • http://rovanenafet.getenjoyment.net/lemazuru.pdf
    • https://kavasudominid.weebly.com/uploads/1/3/0/8/130813783/2406971.pdf
    • http://airbin.top/atonement_book_analysisahmpc.pdf
    • https://cdn.sqhk.co/tamejenonisi/hp7H8ib/sword_knights_idle_rpg_wiki.pdf
    • https://bodosimif.weebly.com/uploads/1/3/3/9/133999894/rusodematelexuxowox.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://2978fa49-077f-489e-bef2-0e177375ffd3.filesusr.com/ugd/50ba8f_733651f0672b46188d3d64b5cad35f15.pdf?index=true
    • https://def05634-b969-4265-beeb-1e7d695e9a44.filesusr.com/ugd/6865ce_f7568857a81a441e94d1b9dea7419c5e.pdf?index=true
    • http://nofolimuri.myartsonline.com/46635837114.pdf
    • https://7c50ec62-1ece-451b-b03c-4788199016cf.filesusr.com/ugd/635f3c_aee4840ed49f4bd18ab08f338d33aad3.pdf?index=true
    • https://s3.amazonaws.com/nowokil/chapter_2_thesis_format_tagalog.pdf
    • https://s3.amazonaws.com/rexogeguxosix/sajuronajivisubopojuwofi.pdf
    • https://20996a60-9695-4f45-8fdb-44bdc783da55.filesusr.com/ugd/c57cae_f160055820684cb094bbc4d60d26a00a.pdf?index=true
    • http://gafodix.myartsonline.com/rukukiranolujoponoba.pdf
    • https://c8a164a7-2549-4056-b209-d27d417f800b.filesusr.com/ugd/136d3d_c9f8d794860f41f8b164d139496c8136.pdf?index=true
    • https://s3.amazonaws.com/wajibile/malt_lymphoma_guidelines.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00049884.bin
73259dfd8b41bb4ab51a677432770c16a0da200f7bbdae9c058039a86f570379		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49884 5088 bytes
font_01_sfnt_off0004a992.bin
b5061fcb5b5b720c57de6dac22d4aefb6eae6816c2dfed62a35cc7ea4e11a3cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A992 14468 bytes
font_02_sfnt_off0004d798.bin
1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4D798 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.