Malicious PDF — malware analysis report

Static analysis result for SHA-256 d060284500d9a25c…

MALICIOUS

PDF

74.2 KB Created: 2021-04-07 03:08:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a634245daca2d05fb14667816567b5a3 SHA-1: e1ac7551a717a4509930b3219a7b34c23b51c104 SHA-256: d060284500d9a25ce23016c8593862ddb60c5afb6278c9ff011596404270a7c4
144 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF document contains a lure to install a browser extension or update, a common social-engineering tactic. It also includes an external URI pointing to 'lozipotod.ru', likely a malicious domain used for hosting or distributing further payloads. ClamAV detection as 'Pdf.Phishing.Trojan' further supports the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=beach+buggy+racing++windows+7
    • https://cdn-cms.f-static.net/uploads/4366668/normal_60229f0dbd950.pdf
    • https://cdn-cms.f-static.net/uploads/4417815/normal_604c9b9db95ec.pdf
    • https://cdn-cms.f-static.net/uploads/4447087/normal_60662869e2033.pdf
    • http://lazakefezives.mygamesonline.org/fizaxigawefatotifor.pdf
    • https://cdn-cms.f-static.net/uploads/4477401/normal_6046dfdcf088d.pdf
    • http://xafawotilujos.mypressonline.com/weight_loss_tips_in_urdu.pdf
    • http://gukevipagopu.mywebcommunity.org/rslogix_5000_software.pdf
    • https://cdn-cms.f-static.net/uploads/4392861/normal_601298453010b.pdf
    • https://cdn-cms.f-static.net/uploads/4448731/normal_6042dabe79662.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/zakunafu/crappie_fishing_report_jordan_lake_nc.pdf
    • https://s3.amazonaws.com/paxuvagal/sports_management_in_physical_education_book.pdf
    • https://s3.amazonaws.com/gimisorixosu/homeless_bird_gloria_whelan.pdf
    • https://s3.amazonaws.com/leteraxewe/upper_macungie_township_police_report.pdf
    • http://fazaburifug.myartsonline.com/christmas_would_you_rather_questions_school.pdf
    • http://wotidupodugi.myartsonline.com/hoover_windtunnel_3_air_steerable_manual.pdf
    • https://uploads.strikinglycdn.com/files/b54b8df5-b059-49fd-b065-efb80e7c10cd/geometry_formulas_circles_tangent.pdf
    • https://uploads.strikinglycdn.com/files/ac51015a-a84a-42c7-a481-98682012943a/best_pema_chodron_book_for_beginners.pdf
    • https://uploads.strikinglycdn.com/files/ce469b93-f7a9-4f0a-9b74-e003f42e78d3/how_to_get_data_analysis_toolpak_in_excel_for_mac.pdf
    • http://givetupazowo.onlinewebshop.net/3m_masking_tape.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e398.bin
aa4a7940e148ee57d9463ea841c19909f90126875625500017c9ce9a0b009bfe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE398 5632 bytes
font_01_sfnt_off0000f6d5.bin
4e328a5ee24baa2fba8881939fce7413b52b7537626b405c3d77842307473b1c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF6D5 10796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.