Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1daeac8d96492a6…

MALICIOUS

PDF

77.2 KB Created: 2021-03-27 19:11:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fcd3b15f3e4f02c4b1d8728489dff32a SHA-1: 10255946a5570961c8d5cf258864e249ebbff2b1 SHA-256: d1daeac8d96492a6fb2c5ae4ed9cbd04825d8f6ac5940db763e4be4b966ac509
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, indicating a phishing or trojan payload. It contains an embedded URL pointing to 'lozipotod.ru', which is likely used to redirect the user to a malicious site. The document body, though heavily obfuscated, suggests a lure related to 'android' and 'wkhtmltopdf', potentially disguising a malicious download or exploit.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=checked+radio+button+android
    • http://idealica-italiaoficial.site/85277528844vdd09.pdf
    • http://mogudovorezuxok.22web.org/are_hot_tubs_worth_the_money.pdf
    • http://clobuss.ru/wheel_scale_apk_download3e33s.pdf
    • http://lightsex.ru/singer_touch_and_sew_zig_zag_model_750wo3vm.pdf
    • http://zvezdasevera.online/entry_level_manual_testing_jobs_in_njsfuya.pdf
    • http://help-feedback-amzn8.xyz/challenging_cognitive_distortions_worksheetsypv41.pdf
    • http://tepesux.22web.org/american_pastoral_free.pdf
    • http://morpeoplelife.ru/what_is_0.01_significance_levelsmwa3.pdf
    • http://help-copyrightviolationhelpcenter.com/5876152512708a4l.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/f257c613-6850-4b5e-b8b1-40f91453bbd6/the_vampire_diaries_the_struggle_2_temporada_dublado.pdf
    • https://uploads.strikinglycdn.com/files/9f439624-c998-4781-87c9-16149151f1b8/rudefitezam.pdf
    • http://wulimazef.epizy.com/59806897219.pdf
    • https://uploads.strikinglycdn.com/files/ce68da3c-13ba-43c9-a091-1a3bd7aed12d/head_first_java_spring_free_download.pdf
    • https://uploads.strikinglycdn.com/files/d096879d-1c25-4a13-9c75-650aa54499f2/pebigepivudipu.pdf
    • https://uploads.strikinglycdn.com/files/c6fe323c-1807-4ba1-892d-fa9549f634e1/depapidapamasufusa.pdf
    • http://lunoxeliligop.rf.gd/hop_on_pop_book_summary.pdf
    • https://uploads.strikinglycdn.com/files/835c9720-9953-4af9-90a2-dc07fd545f82/meaning_of_module_in_education.pdf
    • https://uploads.strikinglycdn.com/files/e170b220-1cd9-4ea5-8b2f-af64abec6ef1/vtech_handset_cordless_answering_system.pdf
    • https://uploads.strikinglycdn.com/files/c76fc0d7-cbde-4d06-bfb7-b106a0d0a1b4/what_is_the_ending_to_defending_jacob.pdf
    • https://uploads.strikinglycdn.com/files/d8c92227-ed76-4666-a3b8-1ec54d51cd0a/7120361607.pdf
    • https://uploads.strikinglycdn.com/files/a573cf8b-3583-45ac-b0f5-875e85dc87d9/wordpress_user_registration_form_shortcode.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1d9.bin
dcf51885e44ee5893d7bf2cfa771230c1240193a678cce196d385b586fd41f20		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE1D9 4928 bytes
font_01_sfnt_off0000f289.bin
5431abb759799ab37d30ef85c536edc6bbd05092cfc48c1bc18543aa7039f0c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF289 11460 bytes
font_02_sfnt_off00011980.bin
0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11980 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.