Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2ba25779bfea27a…

MALICIOUS

PDF

97.9 KB Created: 2021-03-18 15:40:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b386cfe5442d045cdd3920020f0522cb SHA-1: db528e676a32c92e705c141d141d6a371c4afe93 SHA-256: c2ba25779bfea27a02202bcc6725705279e8886e9152bff5b446862de03711d6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a critical heuristic firing for ClamAV detection. An external URI pointing to 'lozipotod.ru' was extracted, suggesting a phishing or malware distribution attempt. Although no scripts were directly extracted, the PDF structure and embedded URI indicate it's designed to redirect users to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=waiting+for+godot+pdf+bangla
    • https://static.s123-cdn-static.com/uploads/4454677/normal_5fef0a8aa40e7.pdf
    • https://cdn.sqhk.co/konosoka/cRjhjgg/houseparty_sign_up_invalid_date_birthday.pdf
    • https://cdn.sqhk.co/woselukafo/ibHidg1/wipopesabupawusibupipuv.pdf
    • http://fapasevusiledap.mygamesonline.org/walmart_onn_65_inch_tv_228.pdf
    • https://cdn.sqhk.co/lokojagivel/bdB3gfe/city_of_stars_piano_easy_sheet_music.pdf
    • https://cdn-cms.f-static.net/uploads/4476577/normal_6044d145e9548.pdf
    • https://cdn.sqhk.co/wevemugas/gghgd13/lonugakazoveliririze.pdf
    • https://static.s123-cdn-static.com/uploads/4473919/normal_5fcc7765a2f7a.pdf
    • https://cdn.sqhk.co/tufuboloruj/rljaIjj/how_do_you_spell_the_wrong_buzzer_sound.pdf
    • http://gojawufeki.getenjoyment.net/816425240.pdf
    • https://cdn.sqhk.co/gobajejuz/HgjrZhc/kibusewavif.pdf
    • http://kevakigev.medianewsonline.com/94499466665.pdf
    • https://cdn.sqhk.co/gipekoma/whcicQf/preschool_teacher_interview_questions_and_answers.pdf
    • https://cdn.sqhk.co/lezagononek/iayhdif/nakivivasodoriduzuguzu.pdf
    • https://static.s123-cdn-static.com/uploads/4460706/normal_5fcad0205fa33.pdf
    • http://nuvagefo.medianewsonline.com/cv_administrateur_systeme_windows.pdf
    • https://static.s123-cdn-static.com/uploads/4411917/normal_5fe261d5ac3e6.pdf
    • https://cdn.sqhk.co/farafakilof/iD2jbhj/razeletediv.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/tuxenipup/5672436504.pdf
    • https://s3.amazonaws.com/zabevog/waxotalurogipufiwesawojom.pdf
    • https://s3.amazonaws.com/tarajix/performance_appraisal_meaning_in_tamil.pdf
    • https://s3.amazonaws.com/lanaladu/clash_of_clans_android_zu_ios_2018.pdf
    • https://s3.amazonaws.com/wanalovum/digojimuden.pdf
    • http://weparaxopulo.atwebpages.com/hp_probook_6470b_core_i5_specification.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNU
    • http://www.gnu.org/copyleft/gpl.htmRegular

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000103b0.bin
124c2ad648ebea5d13d8b1cf97732b528a704d34e02c160fece17d83a625408f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x103B0 5184 bytes
font_01_sfnt_off0001156d.bin
a7f30ab3760782158c22caa78e4bc46db506db21dd76daaeaf0edc9c79969485		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1156D 23860 bytes
font_02_sfnt_off00015643.bin
8978913feb1a618e9b32b4e0148ccda1765a364ec95963b251cb536c9b6b0512		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15643 9912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.