Malicious PDF — malware analysis report

Static analysis result for SHA-256 be5915162ccf160e…

MALICIOUS

PDF

76.3 KB Created: 2021-03-28 04:45:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 493f1a8824d5d63f71979ad8b6b24064 SHA-1: 23c214b6da83457cbeee540386bbd35ccd028979 SHA-256: be5915162ccf160e10fa329acc3de5b78c60192082dc09753373b50391862bd6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The presence of embedded URLs, specifically 'https://lozipotod.ru/123?utm_term=browser+for+java', suggests the document is designed to redirect users to a potentially harmful site. The document body, though heavily obfuscated, contains metadata related to 'wkhtmltopdf' and a date, hinting at its construction. The primary attack vector appears to be social engineering, luring users to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=browser+for+java
    • https://lukajupuxeburi.weebly.com/uploads/1/3/4/6/134630189/dexunuk_rejogetenem_xemetu_xogeruforoz.pdf
    • https://static.s123-cdn-static.com/uploads/4451374/normal_5fcbcb1e14c79.pdf
    • https://cdn-cms.f-static.net/uploads/4421768/normal_605570af5bf61.pdf
    • http://bigswinner.space/they_are_billions_campaign_guideyi7ef.pdf
    • https://busuguzokiw.weebly.com/uploads/1/3/1/4/131406797/9206295.pdf
    • https://cdn-cms.f-static.net/uploads/4372072/normal_603138a0884bf.pdf
    • https://sisareses.weebly.com/uploads/1/3/1/4/131454440/jejomesinepepa.pdf
    • https://cdn-cms.f-static.net/uploads/4421770/normal_5fe9c7d2833d2.pdf
    • http://presentinsta.online/gilopatigorigenabijul2jon.pdf
    • https://static.s123-cdn-static.com/uploads/4366311/normal_5fc7aa9909363.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://6632aaff-1fe9-4f1d-acb3-7d444e457837.filesusr.com/ugd/ce4b7c_475802d66ec14ab883f7002eea0e1fbb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/09f8008b-4b2d-4a98-b649-ca513ad35e0e/us_history_chapter_19_section_4_the_other_america.pdf
    • https://uploads.strikinglycdn.com/files/97af50bf-ede9-4519-9a2b-ba2a2f74d709/lazifawedadorurinexet.pdf
    • https://s3.amazonaws.com/zozofufulolig/32680390633.pdf
    • https://042e50b4-45d0-4577-915a-c14d43ab21ad.filesusr.com/ugd/18f527_55286e6383c645399af969363c75c9f8.pdf?index=true
    • https://s3.amazonaws.com/fizufapu/2012_avenger_sxt_specs.pdf
    • https://uploads.strikinglycdn.com/files/0bb2224b-7d19-4d1a-bdb0-52ba1687ecf6/33766799121.pdf
    • https://f421159b-d329-41e8-bc42-072bc93e4c50.filesusr.com/ugd/65d6f7_75d528eed0974c7981cc5269b6c16676.pdf?index=true
    • https://s3.amazonaws.com/jinotugiwomo/26081663890.pdf
    • https://uploads.strikinglycdn.com/files/c98b9fd0-c0fe-4b49-b0e1-f05b031f3b6a/atwood_8531_rv_furnace_parts.pdf
    • https://uploads.strikinglycdn.com/files/2e26eadf-aecf-44c2-ab6f-055fc04958a2/short_christmas_story_of_the_birth_of_jesus_in_hindi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e39f.bin
8280ff62e9d1984752698dd88ff37e3e01fc411434cf26e6f7a3714e2e883ef4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE39F 5004 bytes
font_01_sfnt_off0000f4d1.bin
115f508268e1af4f609641ffc30b221d810ad148361aa0c9f5567a877e1c196a		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4D1 15612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.