Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6acd5e5202cd13f…

MALICIOUS

PDF

78.5 KB Created: 2021-04-08 00:46:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 218a72e40790998003a2ac3d267f8fbe SHA-1: d6d6d50b069b4e6353be69cf0c26e31be9b20719 SHA-256: b6acd5e5202cd13f4cb8748c105c5d99b44e23c6b9a7a5b0fee0a229e38d59af
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to 'https://lozipotod.ru/wix?keyword=canon+printer+pixma+mg5422+user+manual', which is highly suspicious and likely leads to a phishing or malware distribution site. The ClamAV detection and ML classifier strongly indicate malicious intent. The document body, though heavily obfuscated, appears to be a lure related to a printer manual.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/wix?keyword=canon+printer+pixma+mg5422+user+manual
    • https://cdn-cms.f-static.net/uploads/4426697/normal_6020531a5ae49.pdf
    • https://cdn-cms.f-static.net/uploads/4387417/normal_6058f7de01f8f.pdf
    • http://allostar.buzz/offer_to_buying_house_without_realtor_canadapaed5.pdf
    • http://eyebrowthreadingdallastx.com/fishing_rods_for_troutdh8fx.pdf
    • http://getplafond.xyz/what_reading_level_is_the_teacher_from_the_black_lagoon9v473.pdf
    • http://migerov.xyz/easy_fingerstyle_bluesdhuku.pdf
    • http://lighterusb24.site/lascal_buggy_board_fitting_guideesb70.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://mubufelijora.epizy.com/harbor_breeze_ceiling_fan_light_kit_with_touch_dimmer.pdf
    • https://uploads.strikinglycdn.com/files/a639d3c5-a8f4-4eac-a340-aeb87ff3a416/lizutuzipofokadipubozavaz.pdf
    • https://443275ec-395d-4f86-84c9-2ed7a250e117.filesusr.com/ugd/7d471d_f68d3c690ad2432f9162a1509e07ed1b.pdf?index=true
    • https://uploads.strikinglycdn.com/files/2cbdb0d8-c868-4fc7-9111-2bcd77f50208/16926651304.pdf
    • https://s3.amazonaws.com/liguwubore/english_worksheets_for_grade_6_online.pdf
    • https://161abad2-7de2-49bb-9904-d6e2a620a662.filesusr.com/ugd/2eec94_5f8727fab0c04249b38fe570cc23507f.pdf?index=true
    • https://c1e70603-6ca1-47bc-880b-b60d7d434995.filesusr.com/ugd/df625d_9d1d26b269954b8489774e34b3890ccb.pdf?index=true
    • https://s3.amazonaws.com/meludav/does_flavored_black_coffee_have_calories.pdf
    • https://uploads.strikinglycdn.com/files/adf80e93-1b3a-4556-9b5e-6ae715a3accc/lg_washing_machine_top_loader_error_code_oe.pdf
    • http://pavitekoruw.rf.gd/anti_deep_freeze_6.62_free_download.pdf
    • https://fc06435f-e709-4c80-b59d-96fa470c1a13.filesusr.com/ugd/bdc04d_25bcd7cc72b24b9fbe073c177e7b217b.pdf?index=true
    • https://d99d9bf7-a5e0-49f2-90ac-0d1bc881463d.filesusr.com/ugd/0182ef_a3ae3184959a4e0b98a7f1ae134f147f.pdf?index=true
    • https://uploads.strikinglycdn.com/files/18781664-158c-4ed5-8251-6df9854d647b/38647476433.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f551.bin
dd4c416abd25ea93a51941e71529156c296ad4b2cfc4a0a83bdb2bf369e544e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF551 5456 bytes
font_01_sfnt_off000107d9.bin
0515a0d9b315d8e87843f5e081fa510b91a3155184aabddc1543088adb177c3d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x107D9 10752 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.