Malicious PDF — malware analysis report

Static analysis result for SHA-256 b84d8afe1f2d990d…

MALICIOUS

PDF

74.4 KB Created: 2021-03-30 20:32:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 382973457da8fb3848fa32b1269ac597 SHA-1: 09836e7f7ca95af7623c59a7f0b2ee7c51cd6700 SHA-256: b84d8afe1f2d990d587b9a8cb721ebd0481d34d9eb2a4253566d9ae16f86737f
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'nipisod.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to educational content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/123?utm_term=6th+grade+math+coordinate+plane+worksheets
    • https://cdn-cms.f-static.net/uploads/4486535/normal_602786ca32e54.pdf
    • https://static.s123-cdn-static.com/uploads/4482869/normal_5fec46f916239.pdf
    • http://instgramcopyrightdispute.com/anodyne_shoes_return_form4d5nd.pdf
    • https://cdn-cms.f-static.net/uploads/4406169/normal_5fda15dd8b309.pdf
    • http://contact-git.top/your_song_original_piano_sheet_musicz0nur.pdf
    • http://limelusefi.iblogger.org/cyberflix_tv_apk_android_box.pdf
    • http://cmb-accueil.com/54177607621nnqa9.pdf
    • https://cdn-cms.f-static.net/uploads/4481520/normal_601f7e5ecac5a.pdf
    • https://cdn-cms.f-static.net/uploads/4376086/normal_60108cad03b45.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6e958930-a50b-4a2b-90e2-95b96d33d242/information_security_issues.pdf
    • https://s3.amazonaws.com/perurulexi/2012_jeep_grand_cherokee_overland_v6_towing_capacity.pdf
    • https://50b7e5d6-ab0e-41ff-bbcb-47d024e5c277.filesusr.com/ugd/45d8ab_64b2c4fc9ade47bab1b2b5b8d9661c49.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bf731731-8a9e-4c4b-b3a9-e3c0616a8715/mezekigepumisetiwinoku.pdf
    • https://uploads.strikinglycdn.com/files/8fd4a4e2-68d9-48c4-bd4b-e213461dcb9a/mackie_profx8v2_mixer_with_usb_and_effects.pdf
    • https://uploads.strikinglycdn.com/files/ed69f2db-2691-4024-a5d6-4e44f27ec8fa/how_to_do_an_interview_for_an_article.pdf
    • https://f7b0ef4b-317e-4f07-901b-4de91a029b50.filesusr.com/ugd/50f142_6da2d358ce8c4172957c6a5a1b42ec02.pdf?index=true
    • https://8b2103c5-345b-48fd-98e3-f19c90c4efd0.filesusr.com/ugd/0e2875_28a7cd90100d40a8806702e825124f60.pdf?index=true
    • http://xopalotopobeda.rf.gd/christian_worship_songs_chords.pdf
    • https://a7da3e60-63c8-46c1-a846-eab7df628ed2.filesusr.com/ugd/bba345_66b6f49a43284785aa88e90106a1368e.pdf?index=true
    • http://pevuzimoba.rf.gd/givun.pdf
    • https://s3.amazonaws.com/toguvaju/avg_antivirus_premium_apk_free.pdf
    • https://uploads.strikinglycdn.com/files/125ad980-943c-4477-b63d-43248647623a/how_much_is_a_samsung_tv_screen_repair.pdf
    • https://s3.amazonaws.com/fotojipifuzitul/rufuxozivitav.pdf
    • http://zakivijojinikij.epizy.com/turiguzeteji.pdf
    • https://e216d865-ddc7-438b-99b2-64609380b1bb.filesusr.com/ugd/7ae8b3_3e477884a72a487b9415bd4dc3ce0321.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e4db.bin
879a03bb63ba0b926f165cc1d7b2f90476ddefeb93c890d83e37060a746f379c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE4DB 5704 bytes
font_01_sfnt_off0000f823.bin
288ace500f235f408206f8eb04dab63d36f7ddefd4a91cb9dd7f7b465bf16fc1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF823 10576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.