Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0539d074acbaba5…

MALICIOUS

PDF

74.6 KB Created: 2021-03-08 03:49:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-04
MD5: f6a4999db9650298c0bb155affad39f6 SHA-1: 9bf8542160a5b4fda3d116ca7f383b51c587df8b SHA-256: b0539d074acbaba5a7206ed11704e5ad7657ca6182c7cf4f469d6ab9db0e00dc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'lozipotod.ru', which is likely a phishing or malware distribution domain. The document body, though heavily obfuscated, suggests a lure related to educational worksheets, aligning with common social engineering tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=graphing+linear+equations+and+inequalities+worksheet+pdf PDF link annotation
    • http://tesar-krd.ru/tanojimizomusamemilrzum1.pdfIn PDF document text
    • http://mkuu.club/wow_toys_guideciegj.pdfIn PDF document text
    • http://com-connexion.xyz/witebuveweshecz.pdfIn PDF document text
    • http://arfesopt.com/gibizog3ko.pdfIn PDF document text
    • http://specialsale.info/cambridge_dictionary_english_spanish_downloadlt9it.pdfIn PDF document text
    • http://everydays.space/98582006380j6pvu.pdfIn PDF document text
    • http://esclub.info/90604714394frzxn.pdfIn PDF document text
    • http://trycabinets.xyz/1986_honda_goldwing_service_manual_free_download0kxbc.pdfIn PDF document text
    • http://raifaisentgo.online/why_do_smoke_detectors_false_alarmkdbjs.pdfIn PDF document text
    • http://trysoda.pro/risk_board_game_ruleso8917.pdfIn PDF document text
    • http://tvoy-ogorod.online/what_are_textured_walls_calleda1wag.pdfIn PDF document text
    • http://motivawka.online/best_buy_kitchenaid_stand_mixer_attachmentsugam8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fulosobezur/66934317683.pdfIn PDF document text
    • https://s3.amazonaws.com/fapaga/dedawisuvize.pdfIn PDF document text
    • https://s3.amazonaws.com/vatakefojunib/look_for_me_rusty_goodman_sheet_music.pdfIn PDF document text
    • https://s3.amazonaws.com/xefezesebusu/flight_landing_video_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb712eb8-74d8-4f1e-b274-8c166e29d25b/gudixutoxegebuwazataj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/651bac88-b51a-4e99-8181-94a98d0c1fe5/ampli_fishman_loudbox_mini_charge_used.pdfIn PDF document text
    • https://s3.amazonaws.com/bupijila/rekujowanorubuwuxuja.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d03c8f4a-69f7-48b3-b35b-1a49e5c1dabc/american_gods_season_3_episode_4_explained.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e48c55d-df10-4b78-8466-9884c360c68a/gofexetidipadirikowik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/89f3b4f9-7f08-42ff-b635-d0fa25104e89/multiple_project_tracking_template_excel_xls.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/40725974-4d24-4647-8c14-f4fa17aad78a/ap_9th_class_physics_textbook_english_medium.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ee952247-3d12-4b06-b630-9a2a624729f7/tepasegofimurejafuj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e716.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE716 5616 bytes
SHA-256: 5dfe2ef284a899f28fe4835c84f6d20fc4b8d840e81a5f403693d6fd7d4b31bc
font_01_sfnt_off0000fa34.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA34 10004 bytes
SHA-256: 352424a6197b4c77fd0d77031b6f81a744a9103364f013b55722700d1af18ab8

Open this report in the interactive analyzer, or submit your own file for analysis.